ISC DHCPD Buffer Overflow Exploit

ISC DHCPD versions 3.0.1rc12 and 3.0.1rc13 contain an exploitable buffer overflow. This exploit, abuses the buffer overflow to create a format string like vulnerability, which in turn is used to write all the agent code to a known location and then overwrite a GOT entry with a pointer to that code. The dhcpd service doesn't fork, hence, if any of the numbers which must be guessed are missed, the service will die. There are mainly two values which must be guessed: The direct parameter access number for the format string, which is hardcoded to 42, and if wrong will surely make the service crash, and the GOT address, which if missed may make the service crash, but more likely will just make the exploit fail. This exploit first tries all the known GOT addresses corresponding to default installations and RPMs (see supported system notes). If this addresses fail to install the agent, the exploit will finish unsuccessfully.