[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Aug 2015 17:00:34 +0200
From: Robert Święcki <robert@...ecki.net>
To: oss-security@...ts.openwall.com
Cc: Andy Lutomirski <luto@...capital.net>, Daniel Kahn Gillmor <dkg@...thhorseman.net>,
Kurt Seifried <kseifried@...hat.com>
Subject: Re: Re: Terminal escape sequences - the new XSS for admins?
2015-08-11 23:59 GMT+02:00 Steve Grubb <sgrubb@...hat.com>:
> On Tuesday, August 11, 2015 02:40:12 PM Andy Lutomirski wrote:
> > > At this point, I was convinced that most major emulators are safe. That
> > > said...there are all the ones I didn't check including older ones. The
> > > older ones are likely to be the ones I'd be most concerned about.
> >
> > Are all the supposedly invulnerable terminals actually safe?
> > Gnome-terminal reports:
> >
> > 0000000: 1b5d 6c54 6572 6d69 6e61 6c1b 5c .]lTerminal.\
> >
> > That's not as bad as echoing 'ls -al' back to the terminal input, but
> > why is it considered acceptable for terminals to input anything
> > whatsoever in response to the in-band data they receive?
>
> The whole idea is to write something that you can bounce back to the
> prompt.
> lTerminal is pretty limiting. An attacker would have to also place the file
> lTerminal in the search path before using this trick. But if they can do
> pre-
> place a file in the search path, they can also take advantage of typing
> mistakes like placing a file vo and then waiting for the admin to make a
> mistake typing vi.
>
> What you really want to do in an attack is to try placing a call back
> shell
> command on the prompt or download/upload files.
>
> Most terminal emulators, konsole for example, reply with nothing. Its the
> vte
> based ones that reply like this.
I was reviewing the code and fuzzing various terminal emulators quite
extensively some time ago, and found that "only" rxvt might be susceptible
to this (if I remember correctly, there's typo in the code that enables
this).
$ echo -ne "\eGQ;"
;$ 0
bash: 0: command not found
If you manage to append some arbitrary bytes to the input queue (except 0
and meaningless sequences like echo -ne "\e[6n\eGQ;"), then this sequence
can be used to execute your command.
As for other terminal emulators, I was able to crash most of them, and from
what I see I still have testcases for konsole, pterm, rxvt, securecrt and
xterm. I was looking for command injections though, so simply forgot to
submit the testcases to the maintainers of the code after the exercise.
I'll do that shortly.
--
Robert Święcki
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
