Re: KEYWORDS: shared objects, dynamic linking,

From: Dave Aitel (daitelat_private)
Date: Sat Oct 20 2001 - 15:44:40 PDT

  • Next message: security curmudgeon: "Re: 0-day exploit..do i hear $1000?"

    True. Although you can still do a lot of interesting things by unsetting suid bits and
    loading your own libraries to override specific functions. Sharefuzz (see www.atstake.com)
    does this for environment variables, which is still quite interesting on, say, Solaris,
    HP-UX, Irix, Tru64, but not very interesting on Linux or BSD. ;>
    
    Even better, you can override, say, xdr_string(), with Sharefuzz, and then just go through
    a normal transaction (say, just log into CDE and open a few programs so that ttdbserverd
    gets accessed a bit - but now every time it loads a string variable from the network
    (through xdr_string()) that string is a long string of %n's. When ttdbserverd crashes, you
    know you've found something worth really digging into. :>
    
    -dave
    
    
    Dom De Vitto wrote:
    
    > This was an old flaw, patched linkers ignore LD_* for
    > setuid exe's...
    >
    > You've got the right idea though...
    >
    > Dom
    >
    > -----Original Message-----
    > From: Aycan Irican [mailto:aycanat_private]
    > Sent: 20 October 2001 12:13
    > To: pen-testat_private
    > Cc: vuln-devat_private; muttyat_private;
    > aydinat_private; evrimat_private
    > Subject: KEYWORDS: shared objects, dynamic linking,
    >
    > *** PGP Signature Status: unknown
    > *** Signer: Unknown, Key ID = 0x2D002BBF
    > *** Signed: 20/10/2001 12:13:30
    > *** Verified: 20/10/2001 23:00:13
    > *** BEGIN PGP VERIFIED MESSAGE ***
    >
    > Hi there,
    > When I'm trying to understand how executables related to shared objects,
    > some
    > questions appeared in my mind(trap)...
    >
    > I'm giving some examples here from the UNIX side...
    > 1.
    >         $ uname -a
    >         OpenUNIX feeddead 5 8.0.0 i386 x86at Caldera UNIX_SVR5
    >         $ ls -al /usr/dt/bin/dtterm
    >         -r-sr-xr-x    1 root     bin           60892 Jun 10 05:03
    > /usr/dt/bin/dtterm
    >
    > here dtterm is suid bit set. To see which shared objects it needs,
    >
    >         $ ldd /usr/dt/bin/dtterm
    >         /usr/dt/bin/dtterm needs:
    >                 libDtTerm.so.1 => /usr/dt/lib/libDtTerm.so.1
    >                 .......
    >                 /usr/lib/libc.so.1
    >
    > it's dynamic section includes this,
    >         Dynamic Section:
    >           NEEDED      libDtTerm.so.1
    >                 ......
    >           RPATH       /usr/dt/lib:/usr/lib
    >                 ......
    > so when it runs, I'm understanding that say "first look /usr/dt/lib for
    > loading libDtTerm.so.1".
    >
    > if it doesn't defined here I think I can overwrite the LD_LIBRARY_PATH
    > environment so I could make this system to load MY OWN
    > libDtTerm.so.1magically :)
    >
    > but in Linux side say /usr/X11R6/bin/xlock
    >         [aycan@mars doc]$ uname -a
    >         Linux deadbeef 2.4.12 #13D SMP Wed Oct 17 11:54:46 CEST 2001 i586       unknown
    >         [aycan@mars doc]$ ls -al /usr/X11R6/bin/xlock
    >         -r-sr-xr-x   1 root     root      1406536 May  3 12:49 /usr/X11R6/bin/xlock
    >
    > I couldn't see any path when I looked at objdump output ...so I think I can
    > export my LD_RUN_PATH variable to inject MY OWN libXpm.so.4 magically :)
    >
    > what I'm doing wrong here?
    > is it possible to inject suspicious shared objects so suid program is
    > compromised?
    > any ideas?
    >
    > tnx...
    > --
    > Aycan rican
    > Systems Engineer
    > Prosoft Communication Systems Ltd.
    > Resit Galip Cad. 85/2 Gaziosmanpaa 06700 Ankara
    > Tel:+90-312-446-6616 Fax:+90-312-446-2423
    >
    > *** END PGP VERIFIED MESSAGE ***
    



    This archive was generated by hypermail 2b30 : Sun Oct 21 2001 - 01:39:13 PDT