Claymore Dual GPU Miner 10.5 – Format String

• Exploit Database
• 130 阅读

• 作者： res1n
  日期： 2018-02-05
• 类别：

  • dos
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/43972/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

  Claymore’s Dual GPU Miner 10.5 and below is vulnerable to a format strings vulnerability. This allows an unauthenticated attacker to read memory addresses, or immediately terminate the mining process causing a denial of service.   After reading about the recent vulnerabilities with previous versions, I thought I should take another look at the json listener on port 3333 and see if there was any avenues of attack.   echo -e '{"id":1,"jsonrpc":"1.0","method":"test"}' | nc 192.168.1.107 3333 & printf "\n"   After realizing the buffer was printed I decided to try a few others…   Sending %s does return some strings, however I couldn’t get the hex addresses padded properly to dig in more as I kept getting unable to parse json errors. Sending %p also did yield some results but I’m sure someone more qualified may be able to exploit the stack further…   Finally, sending %n completely kills the mining process.   echo -e '{"id":1,"jsonrpc":"1.0","method":"%n"}' | nc 192.168.1.139 3333 & printf "\n"   Keep your rigs up to date, or stop opening port 3333 to the public. Seriously.   Timeline 01/26/18 — Reported   01/26/18 —Confirmed and immediately patched. 10.6 released request for 3–4 day embargo   01/31/18 — Public Disclosure