verlihub-exec.txt

`== verlihub <=0.9.8d-RC2 remote r00t / command execution =======================  
| ' / |  
/__ ___ ( /   
\\--`-'-|`---\\ |   
|' _/ ` __/ /   
'._ V ,--'   
'_:_._/   
  
description:--------------------------------------------------------------------  
"Verlihub is a Direct Connect protocol server; runs on Linux OS; written in  
C++."  
-- <http://www.verlihub-project.org/>  
  
Verlihub does not sanitize user input passed to the shell via its "trigger"  
mechanism. Furthermore, the Verlihub daemon can optionally be configured to  
run as root. This allows for the arbitrary execution of commands by users  
connected to the hub and, in the case of the daemon running as root,  
complete commandeering of the machine.  
  
-- Code Listing: src/ctrigger.cpp : cTrigger::DoIt() -------------------   
106 string command(buf); :   
107 filename = server.mConfigBaseDir; ,:   
108 filename.append("/tmp/trigger.tmp"); | / \ |   
109 command.append(" > "); \_\\ //_/   
110 command.append(filename); .'/()\'.   
111 cout << command << endl; \\ //   
112 system(command.c_str());  
------------------------------------------------------------------------   
  
vulnerability check:------------------------------------------------------------  
# grep allow_exec /etc/verlihub/dbconfig  
allow_exec = 1  
  
or  
  
# grep allow_exec $HOME/.verlihub/dbconfig  
allow_exec = 1  
  
exploit:------------------------------------------------------------------------  
1. Connect to a hub with user triggers allowed and set up to accept  
arguments;  
2. Run a trigger with a specially crafted argument, e.g.:  
+<trigger> `cat /etc/passwd`  
where <trigger> is the name of the trigger.  
3. ...  
  
patch:--------------------------------------------------------------------------  
$ diff src/ctrigger.cpp src/ctrigger.cpp.new  
9a10  
> #include <stdio.h>  
19a21,33  
> void strip( char * str, char c )  
> {  
> char * p1 = str;  
> while ( *p1++ )  
> if( *p1 == c )  
> {  
> char * p2 = p1;  
> while( *p2 && *p2 == c ) { ++p2; }  
> if(*p2) { *p1 = *p2; *p2 = c; }  
> else { *p1 = '\0'; break; }  
> }  
> }  
>  
107,114c121,145  
< filename = server.mConfigBaseDir;  
< filename.append("/tmp/trigger.tmp");  
< command.append(" > ");  
< command.append(filename);  
< cout << command << endl;  
< system(command.c_str());  
< buf = "";  
< if (!LoadFileInString(filename,buf)) return 0;  
---  
> char buffer[ 1024 ];  
> FILE * stream;  
> buf = "";  
> char * cmd = command.c_str();  
>  
> strip( cmd, ';' ); strip( cmd, '\"' );  
> strip( cmd, '\'' ); strip( cmd, '\\' );  
> strip( cmd, '`' ); strip( cmd, ':' );  
> strip( cmd, '!' ); strip( cmd, '$' );  
> strip( cmd, '{' ); strip( cmd, '}' );  
> strip( cmd, '[' ); strip( cmd, ']' );  
> strip( cmd, '&' ); strip( cmd, '>' );  
> strip( cmd, '<' ); strip( cmd, '|' );  
> strip( cmd, '~' ); strip( cmd, '/' );  
>  
> cout << cmd << endl;  
> stream = popen( cmd, "r" );  
> if ( stream == NULL )  
> perror( NULL );  
> else  
> while( fgets( buffer, 1024, stream )  
> != NULL )  
> buf.append( buffer );  
> if ( pclose( stream ) == -1 )  
> perror( NULL );  
  
== eof ======================================== by v4lkyrius at gmail dot com ==  
  
`