bugtraq - Re: Arbitrary code execution in eping plugin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 13 Jun 2005 02:36:32 -0400
From: Sam Michaels <samthecomputerman@...il.com>
To: "oliver@...ersquad.de" <oliver@...ersquad.de>
Cc: bugtraq@...urityfocus.com
Subject: Re: Arbitrary code execution in eping plugin

On 11 Jun 2005 20:15:09 -0000, oliver@...ersquad.de
<oliver@...ersquad.de> wrote:
> So only IP-Adresses are allowed and no kind of code injection is possible.

I'm unfamiliar with this particular program, so forgive me if I'm way
off base...however...give this a try:

function eping_validaddr($eping_hosttocheck)
{
  return ip2long($eping_hosttocheck);
}

On a failure, it will return (int)-1 or (bool)FALSE depending on your
PHP version.  Before doing the actual ping, you'll want to grab the
result of eping_validaddr() and run it through long2ip() as a final
step of validation.  Example:

$exploit = long2ip(ip2long('127.0.0.1;commands%20here'));

It will populate $exploit with (string)"255.255.255.255" (just
ip2long() alone on that returns -1 in PHP4 or FALSE in PHP5).

Sam