== verlihub <=0.9.8d-RC2 remote r00t / command execution ======================= | ' / | /__ ___ ( / \\--`-'-|`---\\ | |' _/ ` __/ / '._ V ,--' '_:_._/ description:-------------------------------------------------------------------- "Verlihub is a Direct Connect protocol server; runs on Linux OS; written in C++." -- <http://www.verlihub-project.org/> Verlihub does not sanitize user input passed to the shell via its "trigger" mechanism. Furthermore, the Verlihub daemon can optionally be configured to run as root. This allows for the arbitrary execution of commands by users connected to the hub and, in the case of the daemon running as root, complete commandeering of the machine. -- Code Listing: src/ctrigger.cpp : cTrigger::DoIt() ------------------- 106 string command(buf); : 107 filename = server.mConfigBaseDir; ,: 108 filename.append("/tmp/trigger.tmp"); | / \ | 109 command.append(" > "); \_\\ //_/ 110 command.append(filename); .'/()\'. 111 cout << command << endl; \\ // 112 system(command.c_str()); ------------------------------------------------------------------------ vulnerability check:------------------------------------------------------------ # grep allow_exec /etc/verlihub/dbconfig allow_exec = 1 or # grep allow_exec $HOME/.verlihub/dbconfig allow_exec = 1 exploit:------------------------------------------------------------------------ 1. Connect to a hub with user triggers allowed and set up to accept arguments; 2. Run a trigger with a specially crafted argument, e.g.: +<trigger> `cat /etc/passwd` where <trigger> is the name of the trigger. 3. ... patch:-------------------------------------------------------------------------- $ diff src/ctrigger.cpp src/ctrigger.cpp.new 9a10 > #include <stdio.h> 19a21,33 > void strip( char * str, char c ) > { > char * p1 = str; > while ( *p1++ ) > if( *p1 == c ) > { > char * p2 = p1; > while( *p2 && *p2 == c ) { ++p2; } > if(*p2) { *p1 = *p2; *p2 = c; } > else { *p1 = '\0'; break; } > } > } > 107,114c121,145 < filename = server.mConfigBaseDir; < filename.append("/tmp/trigger.tmp"); < command.append(" > "); < command.append(filename); < cout << command << endl; < system(command.c_str()); < buf = ""; < if (!LoadFileInString(filename,buf)) return 0; --- > char buffer[ 1024 ]; > FILE * stream; > buf = ""; > char * cmd = command.c_str(); > > strip( cmd, ';' ); strip( cmd, '\"' ); > strip( cmd, '\'' ); strip( cmd, '\\' ); > strip( cmd, '`' ); strip( cmd, ':' ); > strip( cmd, '!' ); strip( cmd, '$' ); > strip( cmd, '{' ); strip( cmd, '}' ); > strip( cmd, '[' ); strip( cmd, ']' ); > strip( cmd, '&' ); strip( cmd, '>' ); > strip( cmd, '<' ); strip( cmd, '|' ); > strip( cmd, '~' ); strip( cmd, '/' ); > > cout << cmd << endl; > stream = popen( cmd, "r" ); > if ( stream == NULL ) > perror( NULL ); > else > while( fgets( buffer, 1024, stream ) > != NULL ) > buf.append( buffer ); > if ( pclose( stream ) == -1 ) > perror( NULL ); == eof ======================================== by v4lkyrius at gmail dot com ==