Exploit X-Chat 1.x - CTCP Ping Remote IRC Command Execution

[Exploiter]

EDB-ID

21210

Проверка EDB

1. Пройдено

Автор

MARCUS MEISSNER

Тип уязвимости

REMOTE

Платформа

LINUX

CVE

cve-2002-0006

Дата публикации

2002-01-09

source: https://www.securityfocus.com/bid/3830/info

X-Chat is a graphical client for IRC. It requires the GTK+ toolkit, and is available for many Linux and Unix operating systems.

If a CTCP ping request includes escaped newline characters and additional IRC commands, these commands may be executed by the vulnerable client. It is possible to gain operator status in channels owned by the vulnerable user, or to use their identity to initiate social engineering attacks.

Although this vulnerability exists in recent versions of X-Chat, the option to expand characters has been disabled by default since version 1.4.3. 

cat 21210.exploit - | netcat server 6667 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21210.exploit