Remote Buffer Oveflows

Hey,

I have a simple question. How does the shell (cmd.exe) get bound to a port (ie. how does stdin/stdout get routed through a TCP ip connection).

I guess another way of asking this is how netcat is able to execute cmd.exe and bind it to a port, i dont understand how calling cmd from an app that uses sockets makes cmd take commands from sockets and whatnot.

I have read the sourcecode to netcat, but i'm quite overwhelmed it's really messy.

Any help would be great,
Thanks

EDIT:

I'm talking about WinNT - Win2K - Win XP - Win2k3
(not linux/unix)

Not that I know anything about netcat, but tedbob1 did a series of tuts that may help.

http://www.antionline.com/showthread...hreadid=231562

messy it may be but still very effective. its no different than telnet. in the telnet configuration you tell it to run cmd.exe, far, midnight commander whatever, after a shell is established. not so elequently in netcat you do it with the -e flag (-ecmd.exe -efar.exe etc). really whats the differance if your directing output stright to your monitor or to a socket? its all ones and zeros untill it gets where its going so too speak.

i just found myself clicking on "buffer overflows" and found myself here again. so i guess your asking how does a buffer overflow get netcat to do this. well the buffer overflow does not contain nc (netcat) nor usually does the computer thats attacted. buffer overflows are very limited in size so one might open a shell that takes comands and with that use tftp to download larger files and run them or the exploit code might just issue the commands to tftp nc and run it with argumants depending on how much space the overflow provides. usually the shell thats created in this way is a 'reverse' shell that is the attacker needs to have two instances of nc running on her/his machine one sending commands and the other listening for responses. nc is not needed on the remote machine its just easier for the attacker to do so

Quote:

---

Originally posted here by Tedob1
messy it may be but still very effective. its no different than telnet. in the telnet configuration you tell it to run cmd.exe, far, midnight commander whatever, after a shell is established. not so elequently in netcat you do it with the -e flag (-ecmd.exe -efar.exe etc). really whats the differance if your directing output stright to your monitor or to a socket? its all ones and zeros untill it gets where its going so too speak.

i just found myself clicking on "buffer overflows" and found myself here again. so i guess your asking how does a buffer overflow get netcat to do this. well the buffer overflow does not contain nc (netcat) nor usually does the computer thats attacted. buffer overflows are very limited in size so one might open a shell that takes comands and with that use tftp to download larger files and run them or the exploit code might just issue the commands to tftp nc and run it with argumants depending on how much space the overflow provides. usually the shell thats created in this way is a 'reverse' shell that is the attacker needs to have two instances of nc running on her/his machine one sending commands and the other listening for responses. nc is not needed on the remote machine its just easier for the attacker to do so

---

Right,

as you said, its just about routeing the 1's and 0's from the shell to the socket and i know this. my original question was, how. How does one do this?

Thanks

in that case you got the answer twice. one look in the tuts and the other with -e
but here it is again
nc -L -p<port> -ecmd.exe

to connect to it:
nv -vv <ipadress> <sameport>

if your asking how to do a buffer overflow...boy are you in the wrong place!

phrack has an article on 'smashing the stack' you'll have to search for the issue

and NewOrder has a good article on it as well

just do us all a favor and don't ask here. just my opinion but i think you might get negged off the site. i could be wrong.

My C/C++ Book has a note that might pertain...

"Remember that redirecting and piping stdin and stdout are features of the operating system and not of the C language itself. However, it does provide another example of the flexibility of streams."

With that, my best guess is that some call to the OS is made. I never looked at the NC src myself, but is there any system calls anywhere? If so, is there a pipe-symbol? (|) If so it is probably done there. The example in my book shows something to the extent that using piping, the program can get its output redirected to another program, such as CMD. So something like "CMD | NC -options" might be done and as NC outputs its data the OS will redirect it into CMD...? Am I making sense? It is just my guess though, since I haven't acturally looked at the sources... I'm lazy at that sort of thing :P.

no,

i'm not asking for how to use netcat, and no i'm not asking about how to do a buffer overflow.

what do you think i am, a script kiddie with a vendetta with my dad or something. Perhaps i'm phrasing this wrong, but i thought i stated this question really well.

Quote:

---

How does the shell (cmd.exe) get bound to a port (ie. how does stdin/stdout get routed through a TCP ip connection).

---

This was the original question. I was asking how to route StdIn/StdOut, not how to use netcat.


If you read my post farther you find:

Quote:

---

I guess another way of asking this is how netcat is able to execute cmd.exe and bind it to a port, i dont understand how calling cmd from an app that uses sockets makes cmd take commands from sockets and whatnot.

---

"How is netcat able" is the key portion of that question.

Does anyone have anyother information to offer?
Thanks

Search the Phrack archives. They have some articles on creating shellcode (which is what you really are after).

"what do you think i am, a script kiddie with a vendetta"

no offense meant but i dont know you and your questions have been vague so i tried to answer any possibility. i investigate/try out every exploit i find trying to understand it. play with the code etc. try it on different machines an so on....im not out to 'get' anybody so i wasn't assuming that of you. but some around here do so i thought id warn ya

stin,stdout, and stderr are just special file descriptors
you can close, open, reopen,... these file descriptors just as you would any other

your question is a little confusing but I think what your referrring to is called "interprocess communication" , where the stdout,stderr of one process is usually redirected back to the stdin of the calling process
you shoud read the man page on popen


heres a little snippet I wrote for interproccess communication where the parent will read up to 32768 characters before closing the pipe and terminating the child process

child_stream = popen(command,"r");
if(child_stream == NULL)
return -1;
y=0;
while((c=fgetc(child_stream))!=EOF)
{
read_buf[y]=c;
y++;
if(y>32767)
break;
}
status = pclose(child_stream);

intresting:

so, would this psuedo code work...

Code:

---

SOCKET s;
char *buffer = new char[32768];

system("cmd.exe");

while(1)
{
        ret = recv(s,buffer,strlen(buffer));
        write(handle_to_cmd,buffer,strlen(buffer));

}

---

how would you take stdout and reroute to socket? Woud you just:

Code:

---

read(handle_to_command,buffer,strlen(buffer));
send(s,buffer,strlen(buffer));

---

S3cur|ty4ng31:
in your code, what type of var is command, how is it defined and assigned. Thanks for the code


Thanks

To answer your question it is done through calls to the operating system (usually through BSD style sockets know as Berkeley Sockets Interface) by creating a socket() and then using bind() to bind a name to the socket which can then be used as an endpoint for communication which the shell uses for input and output.

I reccomend reading the following *nix man entries or the finding the winsock equivalent(for Windows socket programming):

connect(2), listen(2), socket(2), getsockname(2), accept(2), bind(2), connect(2), getprotoent(3), getsockname(2), getsockopt(2), ioctl(2), listen(2), read(2), recv(2), select(2), send(2),
shutdown(2), socketpair(2), write(2)


-Maestr0


Edit: I see your question has already been answered, I was a bit late. :)

command is a char array that has the full path of the binary you wish to run

this is *nix code though and you keep talking about cmd.exe so does this mean yout trying to create a program on windoze?

yes,

said isn't it...

Maestr0: Ya, I'm quite fimilar with winsock programming, however, how would you pass the shell to the bind function? and then i'm assuming that you would have two sockets, one to the shell and one to the target.

ie.

Code:

---

SOCKET listeningSocket;
SOCKET shell;
SOCKET target;
char cmd[] = "C:\\WINNT\SYSTEM32\\cmd.exe";
char *command = new char[32768];
target = accept(listeningSocket,10);

popen(cmd,"rw");
ret = bind(shell,<????>,sizeof(socketaddr_in));
while(ret != 0 || ret != SOCKET_ERROR)
{
    ret = recv(target,command,strlen(command));
    send(shell,command,strlen(command));
    recv(shell,command,strlen(command));
    send(target,command,strlen(command));
}

pclose(cmd); //i know this is wrong, i'm not used to this function
closesocket(target);
closesocket(shell);
closesocket(listeningSocket);

---

something like that?

EDIT:
added close statment's
also, yes this is for windows (preferably XP Home/Pro, but win 2k is fine)

those commad I gave you are for a *nix system.
Ok lets start at the begining again.
Bascially you want a program that listens on a port and executes the commands that are passed to it?Is that correct?

yes,

that is correct.

here is the code youll need for windows then ..

it takes a command and a char array pointer for the data returned, it current only get 1024 chars back but you can change that to whatever you want


DWORD ExecuteAndWaitForCompletion ( LPCTSTR pszCmd, char *temp_data)
{
BOOL bRes;
STARTUPINFO si;
PROCESS_INFORMATION pi;
SECURITY_ATTRIBUTES sa = { sizeof(SECURITY_ATTRIBUTES), NULL, TRUE };
SECURITY_DESCRIPTOR sd;


HANDLE newstdout,read_stdout; //pipe handles
char buf[1024];
unsigned long exit=0; //process exit code
unsigned long bread; //bytes read
unsigned long avail;
unsigned start_time;


strncpy(temp_data,"",1);
ZeroMemory ( &si, sizeof ( STARTUPINFO));

si.cb = sizeof ( STARTUPINFO);
si.dwFlags = STARTF_USESHOWWINDOW;
si.wShowWindow = SW_HIDE;

if (IsWinNT()) //initialize security descriptor (Windows NT)
{
InitializeSecurityDescriptor(&sd,SECURITY_DESCRIPTOR_REVISION);
SetSecurityDescriptorDacl(&sd, true, NULL, false);
sa.lpSecurityDescriptor = &sd;
}
else sa.lpSecurityDescriptor = NULL;
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.bInheritHandle = true; //allow inheritable handles


si.dwFlags = STARTF_USESTDHANDLES;
if (!CreatePipe(&read_stdout,&newstdout,&sa,0)) //create stdout pipe
{
ErrorMessage("CreatePipe");
getch();
return -1;
}
GetStartupInfo(&si); //set startupinfo for the spawned process
si.dwFlags = STARTF_USESTDHANDLES|STARTF_USESHOWWINDOW;
si.wShowWindow = SW_HIDE;
si.hStdOutput = newstdout;
si.hStdError = newstdout; //set the new handles for the child process




bRes = CreateProcess ( NULL,(char*)pszCmd,NULL,NULL,TRUE,

NORMAL_PRIORITY_CLASS, NULL/*GetEnvironmentStrings()*/,
NULL, &si,&pi);
if(!bRes)
{
_snprintf(temp_data,128,"Process Failed : %s",GetLastError());
return -1;
}
Sleep(3000);

bzero(buf);
start_time = time(NULL);
for(;;) //main program loop
{
if((time(NULL) - start_time )> 45)
{
strcpy(temp_data,"NO MEMORY\nPlugin failed to finish in allotted amount of time\n");
TerminateProcess(bRes,-1);
break;
}


PeekNamedPipe(read_stdout,NULL,NULL,NULL,&avail,NULL);
//check to see if there is any data to read from stdout
if (avail!= 0)
{
bzero(buf);
if (avail > 1023)
{
while (bread >= 1023)
{
ReadFile(read_stdout,buf,1023,&bread,NULL);
strcat(temp_data,buf);
bzero(buf);
}
}
else
{
ReadFile(read_stdout,buf,1023,&bread,NULL);
strcat(temp_data,buf);
}

}

GetExitCodeProcess(pi.hProcess,&exit); //while the process is running

if (exit != STILL_ACTIVE)
{
PeekNamedPipe(read_stdout,NULL,NULL,NULL,&avail,NULL);
//check to see if there is any data to read from stdout
if (avail!= 0)
{
bzero(buf);
if (avail > 1023)
{
while (bread >= 1023)
{
ReadFile(read_stdout,buf,1023,&bread,NULL);
strcat(temp_data,buf);
bzero(buf);
}
}
else
{
ReadFile(read_stdout,buf,1023,&bread,NULL);
strcat(temp_data,buf);
}

}
break;
}
Sleep(500);
}
//cleanup
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
CloseHandle(newstdout);
CloseHandle(read_stdout);

return ( exit);

Thanks,

Thats great =)

Id like to get a copy or your program if possible. I spent a lot of time fixing that windows execution code and it would be nice to see it used in other programs

thanks,

yes, thats what i wanted to do, interprocess communication. I'll look more into applications of pipes.

Thanks for the src =)

Quote:

---

Originally posted here by S3cur|ty4ng31
Id like to get a copy or your program if possible. I spent a lot of time fixing that windows execution code and it would be nice to see it used in other programs

---

ya,

thats not a problem...baiscly the program will be a remote shell =)