[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] Sendmail/Postfix FORWARD Remote Exploit
- To: <kingcope@xxxxxxx>, <fdiggle@xxxxxxxxx>
- Subject: Re: [Full-disclosure] Sendmail/Postfix FORWARD Remote Exploit
- From: "Joey Mengele" <joey.mengele@xxxxxxxxxxxx>
- Date: Thu, 13 Dec 2007 23:47:48 -0500
Dead Fred Diggler,
You are not as much of an expert as you may have thought. Any
foolish teenager can break software, but it takes a computer
science degree to design software. For example, I have found a
design flaw vulnerability (DFV) in your exploit. By passing a
specially crafted argument to the program, an attacker can execute
arbitrary code with Diggler privileges.
I have also uncovered several race conditions. If one executes the
command 'pkill -11' on the program, for example, memory corruption
seems to occur, and most modern operating systems output the buffer
overflow code:
Segmentation fault
I hope you consult with experts before being so hasty to post your
attempt at a technical rant. LOLOL.
J
On Thu, 13 Dec 2007 23:20:21 -0500 Fredrick Diggle
<fdiggle@xxxxxxxxx> wrote:
>You should post this to milw0rm as it can always use quality
>exploit code
>like this. I also have some priv8 code which I would like to
>disclose which
>is the same type of vulnerability.
>
>/*
> * Author: Fredrick Diggle
> * Vuln: execve system call allows arbitrary code execution
> * Status: VERY PRIV8
> * DO NOT RELEASE OR FRED DIGGLE WILL EAT YOUR FAMILY
> */
>#include <stdlib.h>
>#include <stdio.h>
>#include <unistd.h>
>#define INFINITY 73
>#ifdef DIGGLEISAWESOME
>int main(int argc, char **argv) {
> if (argc < 2) { fprintf(stderr, "usage: %s [command to
>run]\n\tPRIV8 Fred
>Diggle 0day\n", argv[0]); return INFINITY; }
> execve(argv[1], &argv[1], 0);
>}
>#endif
>
>
>
>On Dec 13, 2007 8:57 PM, kcope <kingcope@xxxxxxx> wrote:
>
>> exploiting "features"
>>
>> (see attached)
>>
>> - -kcope / 2007
>>
>> --
>> Psssst! Schon vom neuen GMX MultiMessenger gehört?
>> Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
--
Click to find out what your future holds.
http://tagline.hushmail.com/fc/Ioyw6h4c4hGa0drvXmvufi4ArgDbffQvrRqEVUWtggWtVsvGwfC6EY/
>>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/