Re: re: Global HIGH Security Risk

[Jonathan Rickman <jonathan () xcorps net>]

-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 4 Feb 2003, ^Shadown^ wrote:

> Dear Folks,
>
>       Thanks for your answers helpping me on how to post this information without getting in trouble.
>       And to the ones that treat me as if I were stupid, all I have to say is that it was just simple. I don't know 
> why it's not been documented, I've googled hard but couldn't find any thing about it.
>       I've set up a server behind a fw (ipchains) without gcc, with a vulnerable daemon, the fw was set up just to 
> allow the server to go through out by the binded daemon port only.
>       What I did first was just to code an exploit for the vulnerable daemon and added a simple command sequence to 
> write down to the server an uuencoded file using vi editor, then uudecode it and un-tar.gz and that way could upload 
> binary files (which could be tools, sniffers, local exploits, etc). That way I could upload binary to execute on the 
> remote server. But I've wanted to download files too (text and binaries) so I've coded a sniffer which listens for a 
> specific ID-secuence to start/stop dumping to a file. And coded a tool to send the ID-secuence and the file to the 
> sniffer. All this worked right.
>       Then I removed all the programas that could be used as an text editor (joe, vim, cat, ed, etc), 
> uudecode/uuencode, and compressing file tools.
>       And I began to develop a technique which may be apply in any exploit code.
>       It could be done many ways. Every coder is gonna do it it's own way, but I did it mine.
>       I've coded an exploit with few options -f file_to_upload -s spawn_shell.
>       The exploit sends diferent encrypted shellcodes depending the options.
>       A shellcode sends and writes down to /tmp the file which firstly was fragmented by the exploit to be inserted 
> into the multi shellcode sequence.(-f)
>       The other is a standard shellcode.
>       As simple as this, so you can upload and download any file type, and executed on the remote server.
>       I think this explains the idea.
>       I wish to post the PoC, but don't wanna get in trouble.
>       Cheers,
>               ^Shadown^


Again, I'm not trying to play the antagonist here, just asking a question.
If what you're saying is, you placed a vulnerable service behind a packet
filter that allowed inbound connections to the vulnerable service...well,
duh. Of course you can run the exploit.

I'm a bit confused by this statement

"allow the server to go through out by the binded daemon port only"

Are you saying that it's set up the way I described in the paragraph
above?

Once again, I'm not being critical...just trying to get through the
language barrier.

- --
Jonathan Rickman
X Corps Security
http://www.xcorps.net


-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8

iQEVAwUBPj/KjTTwrX0N9QH/AQGpqwf8DXpf+G/uGWIHQwITaiajAMk4y4XTt7+j
jYto+KCNBexdyHKSiEz6BblH2sEOKcJHqreqTDxdMKL+KzkIt34SlFujza4OcS4b
dFmq46PgHDrpEfaskjrKJnwwtwji8bJkU4N1stxei7f5WwyLMYXIZbhTJ6jl4Y9N
YROfUDDw0WlgZ/5Qg9TAIwm26sKf5HDCr/9lTI6ZVp398omZOLtLXoLz7pNf24Er
TL1/MdwX9cJ5LSzkmOm9PP51elRrNZfsPVwllLVJPnGkP5d/TuvnqYpjFeBSC3rs
yPAeAejSO/Gr7YirkA+2TdLTew0xbA6LfBZNVWQsy/o5ewDtfZSZzg==
=6jvh
-----END PGP SIGNATURE-----


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html