finger exploits

[AngryBob]

can a finger buffer overflow exploit be run only from a command line, telnet/ssh etc? or does it actually run from entering
"finger @here.com <insert overflow here?>

on this server there is no sort of "finger log" that i can find, however ssh is not running. therefore my thinking is this machine could not have been rooted from this exploit.

[NUKEM6]

Hmm? I think I was talking to someone about this a very long time ago on another site but I can't really remember too much about it. So in a nutshell it depends on the version of the program. What I mean by that is different versions of programs have diff exploits so type in the version of finger or telnet your are testing "heh lol testing" in google and I am sure all kinds of things will come up??? That’s all I know...

[draziw]

Originally posted here by AngryBob
can a finger buffer overflow exploit be run only from a command line, telnet/ssh etc? or does it actually run from entering
"finger @here.com <insert overflow here?>

on this server there is no sort of "finger log" that i can find, however ssh is not running. therefore my thinking is this machine could not have been rooted from this exploit.

It depends on if it's running as a service or only locally. Many systems still enable finger by default, out of the box. A typical buffer overflow is basically handing an application more information than it's ready (or willing) to handle (and yes, that is very, very, very basic information WRT overflows - there's a bit more to it than just that, but that's enough of a premise to help explain, I think).

And, not sure at what level finger syslogs, if at all. You can try creating a debug level syslog of all facilities and using it... my guess is that you'll only see inetd or xinetd or equivalent log the connection, but finger won't tell you what was sent to it (though a honeypot to do such is simple enough).

In /etc/syslog.conf, you'll need something like:

*.debug[tab]/var/log/debug

Do a "touch" or /var/log/debug, then kill -HUP syslog and you should have a log started. You might remember to remove that entry, the log, and re-HUP syslog when you're done to make sure you don't inadvertantly fill up your disk.

Hope that helps a little!