＋设为首页 ＋添加到收藏夹
编者:相关的文章我们发过,但是发的英文资料．很多朋友不甚了解,所以今天转载本文．
本文转自:http://www.nsfocus.net/ 【程序编程相关:LB5000论坛系统漏洞导制服务器被黑客】
netcat的最新版本1.11版下载:http://www3.hackbase.com/down/37/20041229/5874.htm 【推荐阅读:十分钟在w2k肉鸡上建立apache+c】
【扩展信息:常用黑客工具的使用方法集锦】发布日期:2004-12-27
更新日期:2004-12-29 受影响系统: netcat netcat 1.1描述:
netcat是一款多功能的流行的网络工具.
netcat在处理dns控制部分存在堆栈溢出问题,远程攻击者可以利用这个漏洞以进程权限在系统上执行任意指令. 在dns控制部分缺少正确的缓冲区边界检查,发送带有超长字符串（250字节）的客户端命令,可导致一个栈缓冲区溢出,漏洞可导致没有端口监听功能的工具而又结合netcat使用-e选项来完成功能的应用程序出现问题. <*来源:hat-squad security team （bugtraq@hat-squad.com） 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=110425875504586&w=2 *> 测试方法:警 告
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用.使用者风险自负！hat-squad security team （bugtraq@hat-squad.com）提供了如下测试方法:
/* netcat v1.1, "-e" switch, remote buffer overflow exploit v0.1 homepage..........: http://www.securityfocus.com/tools/139/scoreit affected versions.: v1.1 fix...............: actually none, hobbit is warned 1 month+ ago, and looks like to not act, we let him to spread a backdoor :) risk..............: highly critical. -almost everything loaded as "nc ... -e ..." is vulnerable -educational tools such as the uw-imapd (http://www.washington.edu/imap/) \ contains no port listener, if its loaded with netcat (ie: nc -l -p 143 -t -e \ imapd.exe 25 -t -e pop3d.exe etc..vulnerable..) this small example show you the large impact of this hole. -tools build on netcat , i guess are vulnerable , such as the netcat with authentification or others tools based on netcat without a security check on \ src. -next time you run netcat -e , be sure of what you run because as said hobbit, the "-e" switch is really dangerous!! :ddd compilation.......: 101_ncat.cpp ......... win32 (msvc,cygwin) ... 下一页