Re: Re: Terminal escape sequences - the new XSS for admins?

[Robert Święcki <robert () swiecki net>]

2015-08-11 23:59 GMT+02:00 Steve Grubb <sgrubb () redhat com>:

> On Tuesday, August 11, 2015 02:40:12 PM Andy Lutomirski wrote:
> > > At this point, I was convinced that most major emulators are safe. That
> > > said...there are all the ones I didn't check including older ones. The
> > > older ones are likely to be the ones I'd be most concerned about.
> >
> > Are all the supposedly invulnerable terminals actually safe?
> > Gnome-terminal reports:
> >
> > 0000000: 1b5d 6c54 6572 6d69 6e61 6c1b 5c       .]lTerminal.\
> >
> > That's not as bad as echoing 'ls -al' back to the terminal input, but
> > why is it considered acceptable for terminals to input anything
> > whatsoever in response to the in-band data they receive?
>
> The whole idea is to write something that you can bounce back to the
> prompt.
> lTerminal is pretty limiting. An attacker would have to also place the file
> lTerminal in the search path before using this trick. But if they can do
> pre-
> place a file in the search path, they can also take advantage of typing
> mistakes like placing a file vo and then waiting for the admin to make a
> mistake typing vi.
>
> What you really want to do in an attack is to  try placing a call back
> shell
> command on the prompt or download/upload files.
>
> Most terminal emulators, konsole for example, reply with nothing. Its the
> vte
> based ones that reply like this.


I was reviewing the code and fuzzing various terminal emulators quite
extensively some time ago, and found that "only" rxvt might be susceptible
to this (if I remember correctly, there's typo in the code that enables
this).

$ echo -ne "\eGQ;"
;$ 0
bash: 0: command not found

If you manage to append some arbitrary bytes to the input queue (except 0
and meaningless sequences like echo -ne "\e[6n\eGQ;"), then this sequence
can be used to execute your command.

As for other terminal emulators, I was able to crash most of them, and from
what I see I still have testcases for konsole, pterm, rxvt, securecrt and
xterm. I was looking for command injections though, so simply forgot to
submit the testcases to the maintainers of the code after the exercise.
I'll do that shortly.

-- 
Robert Święcki