satire II

Sorry, the following is only in german due to my limited native language skills :-)

Ich sass neulich in der S-Bahn auf dem Weg zum recurity-labs summit, um
ein paar Freunde wiederzutreffen. In der S-Bahn um mich herum lauter wirklich tolle Leute mit viel
Ahnung ueber Web 2.0, flat-rate-preise und natuerlich - BLOGS!
Dazu die Jungs mit den haengenden Hosen und dieser komischen Musik
(ey, alter - das ging so: uz, uz, uzz. Nee, warte... uzzzzz,uz,uz!) Man lese mehr dazu hier.

Da kam mir die Idee, unsere heutige Welt in einem kleinen Gedicht zusammenzufassen.
Den verantwortlichen Rapper fuer den Originalsong werden die Meisten sicher leidlich kennen,
auch wenn er einem im Radio mittlerweile seltener aufgenoetigt wird.
Wer wirklich gute Musik mag, vertieft sich natuerlich in die Gitarre von Mark Tremonti.
:->

genug geschwafelt:

Mein blog!
---------------

ich habe nichts zu sagen
und das kann ich nicht ertragen,
darum schreib ich das in - mein' blog!

ich gehe noch zur schule,
ich find das alles voll schwul hier,
das schreibe ich in - mein' blog!

besser gesagt geh' ich in die achte,
genau wie die bei der ich immer uebernachte,
wies war schreib ich in - mein' blog!

der typ aus der fuenften,
tut mich immer beschimpfen,
das schreibe ich in - mein' blog!

wenn ich gross bin werd ich politiker,
oder vielleicht auch filmkritiker,
wofuer ich mich entscheide, kommt in - mein' blog!

ich habe weder hefter noch anstand,
und beim tanzen mach ich handstand
ich habe nur - nen block!

Eyes on Exec reloaded

10 years ago or so, I wrote a tool called "Eyes on Exec" (EoE) which was a kernel module for the 2.0, 2.2 and 2.4 Kernel.
It created a device /dev/exec from which one could read all the commands executed recently
including callers PID, EUID etc. Some simple hostbased IDS used this input to ensure that e.g.
pop3d never executed anything. It worked very well. Additionally, code reviewers (myself :)
found it usefull since you easily see if some daemons/applications execute shell programs
in a way that is not obvious to the auditor due to weird library calls. The famous modprobe bug
which used ping as a trigger was found by me with the help of EoE (google for rootprobe exploit).

2.2 times are gone, but the new 2.6 Kernel has a nice API called proc connector which allows
to register for certain events such as fork/exec etc. into the proc FS. One is then notified
whenever the questioned event arrives. Ever wanted to know what man really executes or how
acroread is handling mail sent from within a PDF? :-) Jump towards here.

Puzzle solved

Of course you all found the bug I was talking about after I uploaded the correct
screenshot! ;-) Bash me. You even found minor other issues which should however
not be exploitable.
Nevertheless, wpa_supplicant has got an excellent code structure which is fun to review.
If you ever want to learn how to write your own TLSv1 implementation, have a look at their code.

Spot the fed^H^H^Hbug

There is an interesting bug within wpa_supplicant's ASN.1 parsing. Usually, it uses the OpenSSL
libraray to obtain and parse the X509 certificates. However, it can be compiled to use built-in
X509 e.g. ASN.1 parsing routines to do so. Nearly all X509 functions use
asn1_get_next(). There is a buffer overflow condition within this function. Found it?
Make a comment!

P.S. Our packages do not use the vulnerable parsing code.

P.P.S. Puzzle-solving coming soon :-)

pcapSharp

Check out my libpcap C# binding.
It is a first draft version without Makefile, README etc. but contains all
pcap functions, structures, callbacks etc you need to use libpcap via your mono
environment. If you remove the Main() function you can build your own DLL
and can capture and send packets easier than you ever did in C or C++ ;-)

CVE-2007-4091

It still pays to have a look at open source projects.
rsync 2.6.9 contains two off by one stack overflows, one from which the target buffer is next to the
saved frame pointer.
The problematic function is f_name().
Obviously it expects a target buffer size
of MAXPATHLEN bytes. Otherwise
the size parameter calculation to
strlcpy() is wrong.
Lets have a look at f_name() calls within the two following pictures.
An offset is added to the fname buffer
which is of size MAXPATHLEN.
The offset is the stringlen of dir.root
plus one (due to the slash).
Within successfull_send(), the buffer
should be neighbor of the saved
frame pointer since MAXPATHLEN
does not need to be aligned.
Thus the assumption within the f_name() function about its target buffer size
is wrong.
However there is a check in make_file()
that looks whether any received
dir and pathnames would overrun
MAXPATHLEN bytes. flist_dir_len is exactly what becomes strlen of dir.root later. However, the trailing slash is missing! :-) Happy PoCing!!!
Updated rsync-packages for SUSE are already available via the online updater.
A fix is also available.

satire

Since I am a cynical person (writing exploits if you love programming is cynism too) and
some friends told me to publish some of my artwork I used to do when not in front
of a computer, here we go.
I am sorry if this is only in german, but some jokes make only sense if you have the
language of choice under full control (just like exploiting a C program :-)
In english it would probably read like:"Closing time due to death."

If you don't like it; its OK. Do not bash me for my horrible drawing skills.
Some rsync foo is coming soon, to become technical again.

202c rising

Due to a new law in germany (202c) to prevent cibercrime (huh!), some tools
become illegal. There is a good chance that I will make some links from
previous posts invalid or inaccessible.
Even though none of my tools do anything bad and illegal use is strictly
discouraged some lawyers might feel its still illegal.
Some points:

1. None of my tools/code has bad or illegal intent. Its all for educational purposes
(university work or work I do at job) only. This statement is also contained within any
tool and its license.
2. Everyone is responsible for their own actions. If you abuse ssh to log into foreign
computers and abuse tcpdump to sniff traffic there, its your own fault.
2a) Unfortunally it may even become tcpdump's fault in future.
3. I will try to continue my work, but maybe need to re-order some tools in order
to meet the law. Replacing shellcodes in PoC with "\xcc", not disclosing certain
tools/info to the public etc.; whatever is necessary to be conform to law.
4. I hope anyone will relax soon, and its still possible to enjoy *coding*.

I hope there is no special forces sent to me for a "kill -9" prior to hearing me;
as suggested recently by our interior minister. Nuts.
If you feel that some of my code hits 202c nevertheless, feel free to contact me and
I will remove it if you are right.

OpenSSH 4.6 call graph

Today I had a look at the OpenSSH sources again. It seems to me that they overdo the whole PrivSep thing.
Its quite complicated to follow all the calls across
processes and privileges. Do you think they are bug-free?
I made a call-graph which honours all the different
UIDs and PIDs. I used the graphviz package which
core-dumped once in a while due to the complexity. I know there are
better tools for graphing. You can read a paper
describing my graph-tool using graphviz here or download the
complete OpenSSH 4.6 daemon graph here.

Update:
I just substituted the PDF with a new one. Some
nodes were located within the wrong cluster. It turned
out that one pass (of data recording) is not enough to properly cluster the graph. Its also quite hard to
verify that the nodes are linked correctly. I hope
it is this time! :-) I want to encourage you to submit comments if you feel something is wrong or you (dis-)like
something.

injectso

Since a lot of changes happened to the Linux runtime environment since 2001 and I have
not seen an x86-64 injectso port of Saun Clowes' i386/SPARC injectso, here is a
rewrite by me.