ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
87 lines
No EOL
3.8 KiB
Text
87 lines
No EOL
3.8 KiB
Text
Source: http://bugzilla.maptools.org/show_bug.cgi?id=2712
|
|
|
|
Triggered by "./tiffset POC1"
|
|
|
|
$ ./tiffset POC1
|
|
TIFFReadDirectory: Warning, Unknown field with tag 302 (0x12e) encountered.
|
|
TIFFReadDirectory: Warning, Unknown field with tag 61961 (0xf209) encountered.
|
|
poc3: AdobeDeflate compression support is not configured.
|
|
tiffset: tif_dirwrite.c:2127: int TIFFWriteDirectoryTagCheckedLong8Array(TIFF
|
|
*, uint32 *, TIFFDirEntry *, uint16, uint32, uint64 *): Assertion
|
|
`tif->tif_flags&TIFF_BIGTIFF' failed.
|
|
Aborted
|
|
|
|
The gdb debugging information is listed below:
|
|
(gdb) set args POC1
|
|
(gdb) r
|
|
...
|
|
(gdb) c
|
|
Continuing.
|
|
TIFFReadDirectory: Warning, Unknown field with tag 302 (0x12e) encountered.
|
|
TIFFReadDirectory: Warning, Unknown field with tag 61961 (0xf209) encountered.
|
|
poc2: AdobeDeflate compression support is not configured.
|
|
|
|
Breakpoint 2, TIFFWriteDirectoryTagCheckedLong8Array (tif=<optimized out>,
|
|
ndir=<optimized out>, count=1,
|
|
value=0x615c20, dir=<optimized out>, tag=<optimized out>) at
|
|
tif_dirwrite.c:2127
|
|
2127 assert(tif->tif_flags&TIFF_BIGTIFF);
|
|
(gdb) bt
|
|
#0 0x00007ffff746a428 in __GI_raise (sig=sig@entry=6) at
|
|
../sysdeps/unix/sysv/linux/raise.c:54
|
|
#1 0x00007ffff746c02a in __GI_abort () at abort.c:89
|
|
#2 0x00007ffff7462bd7 in __assert_fail_base (fmt=<optimized out>,
|
|
assertion=assertion@entry=0x7ffff7baf949 "tif->tif_flags&TIFF_BIGTIFF",
|
|
file=file@entry=0x7ffff7baf5c0 "tif_dirwrite.c", line=line@entry=2127,
|
|
function=function@entry=0x7ffff7baf8e2 "int
|
|
TIFFWriteDirectoryTagCheckedLong8Array(TIFF *, uint32 *, TIFFDirEntry *,
|
|
uint16, uint32, uint64 *)") at assert.c:92
|
|
#3 0x00007ffff7462c82 in __GI___assert_fail (assertion=0x7ffff7baf949
|
|
"tif->tif_flags&TIFF_BIGTIFF",
|
|
file=0x7ffff7baf5c0 "tif_dirwrite.c", line=2127,
|
|
function=0x7ffff7baf8e2 "int TIFFWriteDirectoryTagCheckedLong8Array(TIFF *,
|
|
uint32 *, TIFFDirEntry *, uint16, uint32, uint64 *)") at assert.c:101
|
|
#4 0x00007ffff7b4e9cb in TIFFWriteDirectoryTagCheckedLong8Array (tif=0x615010,
|
|
ndir=<optimized out>, count=1,
|
|
value=0x615c20, dir=<optimized out>, tag=<optimized out>) at
|
|
tif_dirwrite.c:2127
|
|
#5 TIFFWriteDirectoryTagLong8Array (count=1, value=0x615c20, tif=<optimized
|
|
out>, ndir=<optimized out>,
|
|
dir=<optimized out>, tag=<optimized out>) at tif_dirwrite.c:1462
|
|
#6 TIFFWriteDirectorySec (tif=<optimized out>, isimage=<optimized out>,
|
|
imagedone=<optimized out>,
|
|
pdiroff=<optimized out>) at tif_dirwrite.c:746
|
|
#7 0x00007ffff7b4f6b5 in TIFFWriteDirectory (tif=0x615010) at
|
|
tif_dirwrite.c:184
|
|
#8 TIFFRewriteDirectory (tif=<optimized out>) at tif_dirwrite.c:360
|
|
#9 0x0000000000402bc7 in main (argc=<optimized out>, argv=<optimized out>) at
|
|
tiffset.c:344
|
|
|
|
Trigged in line tif_dirwrite.c:2127 at function
|
|
TIFFWriteDirectoryTagCheckedLong8Array()
|
|
2122 static int
|
|
2123 TIFFWriteDirectoryTagCheckedLong8Array(TIFF* tif, uint32* ndir,
|
|
TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
|
|
2124 {
|
|
2125 assert(count<0x20000000);
|
|
2126 assert(sizeof(uint64)==8);
|
|
2127 assert(tif->tif_flags&TIFF_BIGTIFF);
|
|
2128 if (tif->tif_flags&TIFF_SWAB)
|
|
2129 TIFFSwabArrayOfLong8(value,count);
|
|
2130
|
|
return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG8,count,count*8,value));
|
|
2131 }
|
|
|
|
[note]: Tiffset sets the value of a TIFF header to a specified value.It will
|
|
modify the raw POC file,so you'd better make a backup file every time you are
|
|
going to run.
|
|
|
|
Credits:
|
|
|
|
This vulnerability is detected by team OWL337, with our custom fuzzer collAFL.
|
|
Please contact ganshuitao@gmail.com and chaoz@tsinghua.edu.cn if you need
|
|
more info about the team, the tool or the vulnerability.
|
|
|
|
|
|
Proof of Concept:
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/42299.zip |