5 ms·
From the exploit code: memset(&serv_addr, '0', sizeof(serv_addr)); That doesn't seem to be correct. The digit character 0 is not the same as the null char
by cremno 12y ago
From the exploit code:
memset(&serv_addr, '0', sizeof(serv_addr));
That doesn't seem to be correct. The digit character 0 is not the same as the null character ('\0'). Just write 0 or use `struct sockaddr_in serv_addr = { 0 };`.
- mnw21cam 12y agoIt is common for code which is designed to trigger security bugs in systems to be published with several errors, so that skiddies can't just compile and run.
- e12e 12y agoWhich makes me sad. Makes it just as easy for dedicated crackers, makes it harder on busy, overworked sysadmins to check. All the script-kids need to do is find someone to help them, so I don't really think this helps anyone.
- benjamincburns 12y agoASCII NUL is indeed 0x0. http://en.m.wikipedia.org/wiki/Null_character http://en.m.wikipedia.org/wiki/Null_character http://www.bibase.com/images/ascii.gif http://www.bibase.com/images/ascii.gif
- masklinn 12y agoBut '0' is not ascii NUL (0x00), it's ascii 0 (0x30).
- eis 12y agoAdditionally there are a bunch of other things very wrong with the exploit code. If the connect() fails, it will use file descriptor 1 which is usually stdout and write the request to it and try to read from it. And there is a problem with strstr() not getting a null terminated string (if the stack memory for recvBuff wasn't automatically zero'd out which some compilers can do). Why do these people bother writing the exploit in C? A curl one liner is good enough. Also the check for 'The request has an invalid header name' seems dubious to me because a proxy in front would likely return a different error (the header name is not invalid but rather the range not satisfyable).
- ehmmm 12y ago'0' != '\0' '0' == 48
- benjamincburns 12y agoI wasn't suggesting anything to the contrary...
- ehmmm 12y agoYes, but there also isn't any NULs in the parent. So you can understand the confusion.
- deleted 12y ago[deleted]