880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
155 lines
No EOL
5.6 KiB
Text
155 lines
No EOL
5.6 KiB
Text
source: https://www.securityfocus.com/bid/48464/info
|
||
|
||
Sybase Advantage Server is prone to an off-by-one buffer-overflow vulnerability.
|
||
|
||
Attackers may exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.
|
||
|
||
Sybase Advantage Server 10.0.0.3 is vulnerable; other versions may also be affected.
|
||
|
||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/35886.zip
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
#######################################################################
|
||
|
||
Luigi Auriemma
|
||
|
||
Application: Sybase Advantage Server
|
||
http://www.sybase.com/products/databasemanagement/advantagedatabaseserver
|
||
Versions: <= 10.0.0.3
|
||
Platforms: Windows, NetWare, Linux
|
||
Bug: off-by-one
|
||
Exploitation: remote, versus server
|
||
Date: 27 Jun 2011 (found 29 Oct 2010)
|
||
Author: Luigi Auriemma
|
||
e-mail: aluigi@autistici.org
|
||
web: aluigi.org
|
||
|
||
|
||
#######################################################################
|
||
|
||
|
||
1) Introduction
|
||
2) Bug
|
||
3) The Code
|
||
4) Fix
|
||
|
||
|
||
#######################################################################
|
||
|
||
===============
|
||
1) Introduction
|
||
===============
|
||
|
||
|
||
From vendor's website:
|
||
"Advantage Database Server is a full-featured, easily embedded,
|
||
client-server, relational database management system that provides you
|
||
with Indexed Sequential Access Method (ISAM) table-based and SQL-based
|
||
data access."
|
||
|
||
|
||
#######################################################################
|
||
|
||
======
|
||
2) Bug
|
||
======
|
||
|
||
|
||
By default the Advantage server (ADS process) listens on the UDP and
|
||
TCP ports 6262 and optionally is possible to specify also a so called
|
||
"internet port" for non-LAN connections.
|
||
|
||
The problem is enough unusual and affects the code that handles a
|
||
certain type of packets on the UDP port.
|
||
In short the server does the following:
|
||
- it uses memcpy to copy the data from the packet into a stack buffer
|
||
of exactly 0x2b8 bytes (handled as 0x2b9 bytes)
|
||
- later this data is handled as a string but no final NULL byte
|
||
delimiter is inserted
|
||
- there is also an off-by-one bug since one byte overwrites the lower
|
||
8bit value of a saved element (a stack pointer 017bff??)
|
||
- after this buffer are located some pushed elements and obviously the
|
||
return address of the function
|
||
- it calls the OemToChar API that changes some bytes of the buffer
|
||
(like those major than 0x7f) till it reaches a 0x00 that "luckily" is
|
||
after the return address
|
||
- so also the return address gets modified, exactly from 0084cb18 to
|
||
00e42d18 that ironically is a valid stack frame somewhat related to
|
||
the starting of the service
|
||
- the data inside this stack address doesn't seems changeable from
|
||
outside and has tons of 0x00 bytes that in this case act like NOPs
|
||
till the zone around 00ebf05b where are located some pushed elements
|
||
- the EBX register contains two bytes of the attacker's data and EBP
|
||
points to such data
|
||
|
||
the following is a resume of these operations:
|
||
|
||
017BF66B 61 61 61 61 61 61 61 61 61 61 61 61 61 61 FF 7B aaaaaaaaaaaaaa<61>{
|
||
017BF67B 01 99 26 C1 71 BC F6 7B 01 18 CB 84 00 00 00 00 .<2E>&<26>q<EFBFBD><71>{..˄....
|
||
|---------|
|
||
original return address
|
||
|
||
0084B81D |. FF15 DC929000 CALL DWORD PTR DS:[<&USER32.OemToCharA>]
|
||
|
||
017BF66B 61 61 61 61 61 61 61 61 61 61 61 61 61 61 A0 7B aaaaaaaaaaaaaa<61>{
|
||
017BF67B 01 D6 26 2D 71 2B F7 7B 01 18 2D E4 00 00 00 00 .<2E>&-q+<2B>{..-<2D>....
|
||
|---------|
|
||
new return address
|
||
|
||
00E42D18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||
00E42D28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||
...
|
||
00EBF04B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
|
||
00EBF05B 00 99 78 82 7C 4A EC 82 7C 20 00 00 00 A0 F0 EB .<2E>x<EFBFBD>|J<><4A>| ...<2E><><EFBFBD>
|
||
00EBF06B 00 A0 F0 EB 00 00 00 00 00 68 F1 EB 00 01 00 00 .<2E><><EFBFBD>.....h<><68>....
|
||
00EBF07B 00 5C F1 EB 00 D1 0F E7 77 A0 F0 EB 00 00 00 00 .\<5C><>.<2E>.<2E>w<EFBFBD><77><EFBFBD>....
|
||
00EBF08B 00 51 02 02 00 EC 0F E7 77 00 D0 FD 7F 00 00 00 .Q...<2E>.<2E>w.<2E><>...
|
||
00EBF09B 00 01 00 00 00 18 00 34 00 02 00 00 00 7C 0A 00 .......4.....|..
|
||
00EBF0AB 00 14 0D 00 00 1C 75 17 00 00 00 00 00 00 00 00 ......u.........
|
||
00EBF0BB 00 51 02 02 00 08 00 00 C0 00 00 00 00 00 00 00 .Q......<2E>.......
|
||
|
||
the code flow usually arrives till 00ebf0ab or other addresses close
|
||
to it depending by the data saved there when the service started.
|
||
|
||
Now for exploiting this vulnerability would be required the presence of
|
||
a "jmp ebp" or "call ebp" or a sequence of instructions with a similar
|
||
result in the 00ebf05b zone which looks like an enough rare event.
|
||
|
||
I have not tested the Linux and NetWare platforms so I don't know if
|
||
the problem exists also there and if there are more chances of
|
||
exploiting it.
|
||
|
||
|
||
#######################################################################
|
||
|
||
===========
|
||
3) The Code
|
||
===========
|
||
|
||
|
||
http://aluigi.org/testz/udpsz.zip
|
||
http://aluigi.org/poc/ads_crc.zip
|
||
|
||
udpsz -C 0012 -L ads_crc.dll -b 0x61 SERVER 6262 0x592
|
||
|
||
|
||
#######################################################################
|
||
|
||
======
|
||
4) Fix
|
||
======
|
||
|
||
|
||
No fix.
|
||
|
||
UPDATE:
|
||
vendor has fixed the bug in version 10.10.0.16 released in July 2011:
|
||
http://devzone.advantagedatabase.com/dz/content.aspx?key=44&id=ef0915fb-44c2-fe4b-ac26-9ed3359cffff
|
||
|
||
|
||
####################################################################### |