/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / hacking / unix / at_explo.txt

< prev

next >

MacOS 8.1

Win98

DOS

view JSON data

view as text

+--------+-------------------------+-------------------------+--------+--------+
|00000000| 46 72 6f 6d 20 62 65 73 | 74 2d 6f 66 2d 73 65 63 |From bes|t-of-sec|
|00000010| 75 72 69 74 79 2d 72 65 | 71 75 65 73 74 40 73 75 |urity-re|quest@su|
|00000020| 62 75 72 62 69 61 2e 6e | 65 74 20 4d 6f 6e 20 41 |burbia.n|et Mon A|
|00000030| 75 67 20 32 36 20 31 30 | 3a 32 32 3a 31 30 20 31 |ug 26 10|:22:10 1|
|00000040| 39 39 36 0a 52 65 73 65 | 6e 74 2d 44 61 74 65 3a |996.Rese|nt-Date:|
|00000050| 20 54 75 65 2c 20 32 37 | 20 41 75 67 20 31 39 39 | Tue, 27| Aug 199|
|00000060| 36 20 30 30 3a 31 38 3a | 31 37 20 2b 31 30 30 30 |6 00:18:|17 +1000|
|00000070| 0a 44 61 74 65 3a 20 4d | 6f 6e 2c 20 32 36 20 41 |.Date: M|on, 26 A|
|00000080| 75 67 20 31 39 39 36 20 | 32 33 3a 34 39 3a 31 37 |ug 1996 |23:49:17|
|00000090| 20 2b 31 30 30 30 0a 46 | 72 6f 6d 3a 20 44 6f 6e | +1000.F|rom: Don|
|000000a0| 20 46 72 61 6d 65 72 20 | 3c 73 77 6f 6f 70 40 73 | Framer |<swoop@s|
|000000b0| 75 62 75 72 62 69 61 2e | 6e 65 74 3e 0a 54 6f 3a |uburbia.|net>.To:|
|000000c0| 20 70 72 6f 66 66 40 73 | 75 62 75 72 62 69 61 2e | proff@s|uburbia.|
|000000d0| 6e 65 74 0a 53 65 6e 64 | 65 72 3a 20 70 72 6f 66 |net.Send|er: prof|
|000000e0| 66 40 73 75 62 75 72 62 | 69 61 2e 6e 65 74 0a 52 |f@suburb|ia.net.R|
|000000f0| 65 73 65 6e 74 2d 46 72 | 6f 6d 3a 20 62 65 73 74 |esent-Fr|om: best|
|00000100| 2d 6f 66 2d 73 65 63 75 | 72 69 74 79 40 73 75 62 |-of-secu|rity@sub|
|00000110| 75 72 62 69 61 2e 6e 65 | 74 0a 58 2d 4d 61 69 6c |urbia.ne|t.X-Mail|
|00000120| 69 6e 67 2d 4c 69 73 74 | 3a 20 3c 62 65 73 74 2d |ing-List|: <best-|
|00000130| 6f 66 2d 73 65 63 75 72 | 69 74 79 40 73 75 62 75 |of-secur|ity@subu|
|00000140| 72 62 69 61 2e 6e 65 74 | 3e 20 61 72 63 68 69 76 |rbia.net|> archiv|
|00000150| 65 2f 6c 61 74 65 73 74 | 2f 32 37 34 0a 58 2d 4c |e/latest|/274.X-L|
|00000160| 6f 6f 70 3a 20 62 65 73 | 74 2d 6f 66 2d 73 65 63 |oop: bes|t-of-sec|
|00000170| 75 72 69 74 79 40 73 75 | 62 75 72 62 69 61 2e 6e |urity@su|burbia.n|
|00000180| 65 74 0a 50 72 65 63 65 | 64 65 6e 63 65 3a 20 6c |et.Prece|dence: l|
|00000190| 69 73 74 0a 52 65 73 65 | 6e 74 2d 53 65 6e 64 65 |ist.Rese|nt-Sende|
|000001a0| 72 3a 20 62 65 73 74 2d | 6f 66 2d 73 65 63 75 72 |r: best-|of-secur|
|000001b0| 69 74 79 2d 72 65 71 75 | 65 73 74 40 73 75 62 75 |ity-requ|est@subu|
|000001c0| 72 62 69 61 2e 6e 65 74 | 0a 53 75 62 6a 65 63 74 |rbia.net|.Subject|
|000001d0| 3a 20 42 6f 53 3a 20 62 | 75 6c 6c 73 68 69 74 3f |: BoS: b|ullshit?|
|000001e0| 0a 0a 72 30 30 74 20 61 | 64 76 69 73 6f 72 79 09 |..r00t a|dvisory.|
|000001f0| 09 09 09 09 09 5b 20 73 | 6f 6c 20 32 2e 35 20 61 |.....[ s|ol 2.5 a|
|00000200| 74 28 31 29 20 5d 0a 09 | 09 09 09 09 09 09 5b 20 |t(1) ]..|......[ |
|00000210| 41 75 67 20 32 34 20 31 | 39 39 36 20 20 20 5d 0a |Aug 24 1|996   ].|
|00000220| 0a 2d 2d 20 53 79 6e 70 | 6f 73 69 73 0a 54 68 65 |.-- Synp|osis.The|
|00000230| 72 65 20 65 78 69 73 74 | 73 20 61 20 76 75 6e 65 |re exist|s a vune|
|00000240| 72 61 62 69 6c 69 74 79 | 20 69 6e 20 74 68 65 20 |rability| in the |
|00000250| 61 74 28 31 29 20 70 72 | 6f 67 72 61 6d 20 74 68 |at(1) pr|ogram th|
|00000260| 61 74 20 77 69 6c 6c 20 | 61 6c 6c 6f 77 20 61 6e |at will |allow an|
|00000270| 79 20 75 73 65 72 0a 74 | 6f 20 65 78 65 63 75 74 |y user.t|o execut|
|00000280| 65 20 61 72 62 69 74 72 | 61 79 20 63 6f 6d 6d 61 |e arbitr|ay comma|
|00000290| 6e 64 73 20 61 73 20 72 | 30 30 74 2e 20 20 54 68 |nds as r|00t.  Th|
|000002a0| 65 20 61 74 20 70 72 6f | 67 72 61 6d 20 77 69 6c |e at pro|gram wil|
|000002b0| 6c 20 67 6c 61 64 6c 79 | 20 6f 76 65 72 66 6c 6f |l gladly| overflo|
|000002c0| 77 0a 69 74 27 73 20 73 | 74 61 63 6b 20 77 69 74 |w.it's s|tack wit|
|000002d0| 68 20 77 68 61 74 65 76 | 65 72 20 64 61 74 61 20 |h whatev|er data |
|000002e0| 69 73 20 70 61 73 73 65 | 64 20 74 6f 20 69 74 20 |is passe|d to it |
|000002f0| 6f 6e 20 74 68 65 20 63 | 6f 6d 6d 61 6e 64 20 6c |on the c|ommand l|
|00000300| 69 6e 65 2e 0a 0a 2d 2d | 20 45 78 70 6c 6f 69 74 |ine...--| Exploit|
|00000310| 61 62 69 6c 69 74 79 0a | 72 30 30 74 20 68 61 73 |ability.|r00t has|
|00000320| 20 74 65 73 74 65 64 20 | 74 68 69 73 20 76 75 6e | tested |this vun|
|00000330| 65 72 61 62 69 6c 69 74 | 79 20 61 6e 64 20 73 75 |erabilit|y and su|
|00000340| 63 63 65 73 73 66 75 6c | 6c 79 20 72 75 6e 20 74 |ccessful|ly run t|
|00000350| 68 65 20 69 64 28 31 29 | 20 70 72 6f 67 72 61 6d |he id(1)| program|
|00000360| 20 61 73 0a 65 75 69 64 | 20 72 30 30 74 20 66 72 | as.euid| r00t fr|
|00000370| 6f 6d 20 61 20 6e 6f 6e | 20 72 6f 6f 74 20 61 63 |om a non| root ac|
|00000380| 63 6f 75 6e 74 2e 20 20 | 42 79 20 6d 61 6b 69 6e |count.  |By makin|
|00000390| 67 20 61 6e 20 65 6e 76 | 69 72 6f 6e 6d 65 6e 74 |g an env|ironment|
|000003a0| 20 76 61 72 69 61 62 6c | 65 20 63 6f 6e 74 61 69 | variabl|e contai|
|000003b0| 6e 0a 6e 61 74 69 76 65 | 20 6d 61 63 68 69 6e 65 |n.native| machine|
|000003c0| 20 63 6f 64 65 20 61 6e | 64 20 70 61 73 73 69 6e | code an|d passin|
|000003d0| 67 20 69 74 20 61 73 20 | 61 20 70 61 72 61 6d 61 |g it as |a parama|
|000003e0| 74 65 72 20 74 6f 20 74 | 68 65 20 61 74 28 31 29 |ter to t|he at(1)|
|000003f0| 20 70 72 6f 67 72 61 6d | 20 79 6f 75 0a 6d 61 79 | program| you.may|
|00000400| 20 66 6f 72 63 65 20 61 | 74 20 74 6f 20 65 78 65 | force a|t to exe|
|00000410| 63 75 74 65 20 79 6f 75 | 72 20 63 6f 64 65 20 61 |cute you|r code a|
|00000420| 73 20 72 30 30 74 2e 0a | 0a 4d 61 63 68 69 6e 65 |s r00t..|.Machine|
|00000430| 20 63 6f 64 65 20 73 75 | 63 68 20 61 73 20 74 68 | code su|ch as th|
|00000440| 65 20 66 6f 6c 6c 6f 77 | 69 6e 67 20 6d 61 6b 65 |e follow|ing make|
|00000450| 73 20 61 20 66 69 6e 65 | 20 65 78 61 6d 70 6c 65 |s a fine| example|
|00000460| 3a 0a 20 20 20 75 6e 73 | 69 67 6e 65 64 20 65 78 |:.   uns|igned ex|
|00000470| 65 63 5b 49 4e 53 54 52 | 55 43 54 49 4f 4e 53 5d |ec[INSTR|UCTIONS]|
|00000480| 3d 20 7b 0a 09 20 20 20 | 20 30 78 39 66 63 30 32 |= {..   | 0x9fc02|
|00000490| 30 32 63 2c 0a 09 20 20 | 20 20 30 78 63 30 32 34 |02c,..  |  0xc024|
|000004a0| 37 66 66 35 2c 0a 09 20 | 20 20 20 30 78 65 32 32 |7ff5,.. |   0xe22|
|000004b0| 37 62 66 66 30 2c 0a 09 | 20 20 20 20 30 78 63 30 |7bff0,..|    0xc0|
|000004c0| 32 37 62 66 66 34 2c 0a | 09 20 20 20 20 30 78 39 |27bff4,.|.    0x9|
|000004d0| 32 30 37 62 66 66 30 2c | 0a 09 20 20 20 20 30 78 |207bff0,|..    0x|
|000004e0| 39 30 31 64 32 30 30 61 | 2c 0a 09 20 20 20 20 30 |901d200a|,..    0|
|000004f0| 78 39 30 31 61 32 30 30 | 61 2c 0a 09 20 20 20 20 |x901a200|a,..    |
|00000500| 30 78 38 32 31 30 32 30 | 33 62 2c 0a 09 20 20 20 |0x821020|3b,..   |
|00000510| 20 30 78 39 31 64 30 32 | 30 30 38 2c 0a 09 20 20 | 0x91d02|008,..  |
|00000520| 20 20 30 78 38 32 31 30 | 32 30 30 31 2c 0a 09 20 |  0x8210|2001,.. |
|00000530| 20 20 20 30 78 39 31 64 | 30 32 30 30 38 2c 0a 09 |   0x91d|02008,..|
|00000540| 20 20 20 20 30 78 61 33 | 63 33 65 30 30 34 0a 09 |    0xa3|c3e004..|
|00000550| 7d 3b 0a 20 20 20 20 63 | 68 61 72 20 2a 63 6d 64 |};.    c|har *cmd|
|00000560| 3d 22 2f 62 69 6e 2f 69 | 64 22 3b 0a 0a 46 6f 72 |="/bin/i|d";..For|
|00000570| 20 74 68 69 73 20 65 78 | 70 6c 6f 69 74 20 74 6f | this ex|ploit to|
|00000580| 20 77 6f 72 6b 20 61 20 | 6d 61 6c 69 63 6f 75 73 | work a |malicous|
|00000590| 20 68 61 63 6b 65 72 20 | 77 6f 75 6c 64 20 68 61 | hacker |would ha|
|000005a0| 76 65 20 74 6f 20 66 69 | 6c 6c 20 61 6e 20 65 6e |ve to fi|ll an en|
|000005b0| 76 69 72 6f 6e 20 0a 76 | 61 72 69 61 62 6c 65 20 |viron .v|ariable |
|000005c0| 77 69 74 68 20 67 61 72 | 62 61 67 65 20 28 77 65 |with gar|bage (we|
|000005d0| 6c 6c 2c 20 6e 6f 70 73 | 20 6f 72 20 65 71 75 69 |ll, nops| or equi|
|000005e0| 76 29 2c 20 61 6e 64 20 | 74 68 65 20 61 62 6f 76 |v), and |the abov|
|000005f0| 65 20 6d 61 63 68 69 6e | 65 20 63 6f 64 65 0a 66 |e machin|e code.f|
|00000600| 6f 6c 6c 6f 77 65 64 20 | 69 6d 6d 65 64 69 61 74 |ollowed |immediat|
|00000610| 65 6c 79 20 62 79 20 74 | 68 65 20 63 6d 64 20 73 |ely by t|he cmd s|
|00000620| 74 72 69 6e 67 2e 0a 0a | 2d 2d 20 46 69 78 65 73 |tring...|-- Fixes|
|00000630| 20 3f 0a 0a 49 6e 20 74 | 68 65 20 73 70 69 72 69 | ?..In t|he spiri|
|00000640| 74 20 6f 66 20 70 61 73 | 74 20 61 64 76 69 73 6f |t of pas|t adviso|
|00000650| 72 69 65 73 2c 20 6f 75 | 72 20 66 69 72 73 74 20 |ries, ou|r first |
|00000660| 73 75 67 67 65 73 74 69 | 6f 6e 20 69 73 20 74 6f |suggesti|on is to|
|00000670| 20 64 6f 77 6e 67 72 61 | 64 65 20 74 6f 20 61 20 | downgra|de to a |
|00000680| 0a 55 4e 49 58 20 73 6f | 20 6f 6c 64 20 74 68 61 |.UNIX so| old tha|
|00000690| 74 20 69 74 20 64 6f 65 | 73 6e 27 74 20 79 65 74 |t it doe|sn't yet|
|000006a0| 20 63 6f 6e 74 61 69 6e | 20 74 68 65 20 61 74 28 | contain| the at(|
|000006b0| 31 29 20 66 65 61 74 75 | 72 65 2e 20 20 49 66 20 |1) featu|re.  If |
|000006c0| 74 68 61 74 20 69 73 20 | 6e 6f 74 0a 61 20 76 69 |that is |not.a vi|
|000006d0| 61 62 6c 65 20 6f 70 74 | 69 6f 6e 20 66 6f 72 20 |able opt|ion for |
|000006e0| 79 6f 75 2c 20 74 68 65 | 6e 20 70 65 72 68 61 70 |you, the|n perhap|
|000006f0| 73 20 79 6f 75 20 73 68 | 6f 75 6c 64 20 6a 75 73 |s you sh|ould jus|
|00000700| 74 20 63 68 6d 6f 64 20 | 37 35 35 20 2f 62 69 6e |t chmod |755 /bin|
|00000710| 2f 61 74 2e 0a 0a 72 30 | 30 74 20 2d 2d 20 6d 6f |/at...r0|0t -- mo|
|00000720| 76 69 6e 67 20 61 74 20 | 74 68 65 20 73 70 65 65 |ving at |the spee|
|00000730| 64 20 6f 66 20 62 75 73 | 69 6e 65 73 73 2e 0a 0a |d of bus|iness...|
|00000740| 0a 0a                   |                         |..      |        |
+--------+-------------------------+-------------------------+--------+--------+