CVE-2023-39785堆栈溢出漏洞分析

US_AC8V4.0si_V16.03.34.06_cn_TDC01.bin

cp /bin/qemu-mipsel-static ./ sudo chroot . ./qemu-mipsel-static ./bin/sh

 ./qemu-mipsel-static -g 1234 ./bin/httpdgdb-multiarch set arch mips set solib-search-path /your lib path file /your httpd path target remote 192.168.0.1:1234

  while ( 1 )  {    lan_ifname = ifaddrs_get_lan_ifname();    if ( ifaddrs_get_ifip(lan_ifname, v10) >= 0 )      break;    sleep(1u);  }

li    $a0, 1           # secondsla    $v0, sleepnopmove    $t9, $v0jalr    $t9 ; sleepnoplw      $gp, 0x6B8+var_6A8($fp)b      loc_43ACECnop

lan_ifname = ifaddrs_get_lan_ifname();if ( ifaddrs_get_ifip(lan_ifname, v10) < 0 )    sleep(1u);

└─$ sudo chroot . ./qemu-mipsel-static  ./bin/httpd        sh: can't create /proc/sys/kernel/core_pattern: nonexistent directory

 Yes:

       ****** WeLoveLinux****** 

  ****** Welcome to ****** connect: No such file or directory func:cfms_mib_proc_handle, line:191 connect cfmd is error.  connect: No such file or directory func:cfms_mib_proc_handle, line:191 connect cfmd is error.  connect: No such file or directory func:cfms_mib_proc_handle, line:191 connect cfmd is error.  connect: No such file or directory func:cfms_mib_proc_handle, line:191 connect cfmd is error.  connect: No such file or directory func:cfms_mib_proc_handle, line:191 connect cfmd is error.  connect: No such file or directory func:cfms_mib_proc_handle, line:191 connect cfmd is error.  connect: No such file or directory func:cfms_mib_proc_handle, line:191 connect cfmd is error.  connect: No such file or directory func:cfms_mib_proc_handle, line:191 connect cfmd is error.  sh: can't create /etc/httpd.pid: nonexistent directory sh: can't create /proc/sys/net/ipv4/tcp_timestamps: nonexistent directory [httpd][debug]----------------------------webs.c,158 bind: Address in use bind: Address in use bind: Address in use bind: Address in use bind: Address in use websOpenListen 253: Couldn't open a socket on ports 80 initWebs 511: websOpenServer failed main -> initWebs failed

   v20.s_addr = ifaddrs_get_interface_addr("br0");   ifaddrs_get_if_netmask("br0", v17);

sudo ip link add br0 type bridge sudo ip link set dev br0 up sudo ip link set dev eth0 master br0 sudo ip address add 192.168.0.1/24 dev br0     sudo ip link set br0 up[httpd][debug]----------------------------webs.c,158 httpd listen ip = 192.168.0.1 port = 80 webs: Listening for HTTP requests at address 192.168.0.1

inet_aton(g_lan_ip, &in);strcpy(v6, off_504620);websSetDefaultDir(v6);

lrwxrwxrwx  1 kali kali       9 Nov  6 05:05 webroot -> /dev/null

rm -rf webrootln -s webroot_ro/ webroot

0x0048d188 in set_qosMib_list ()(gdb) ni

Program received signal SIGSEGV, Segmentation fault.0x3ffc5038 in ?? ().text:0048D184 move    $t9, $v0.text:0048D188 bal     set_client_qos.text:0048D18C nop