Menu

Search for hundreds of thousands of exploits

"Screen 4.0.3 (OpenBSD) - Local Authentication Bypass"

Author

Exploit author

Rembrandt

Platform

Exploit platform

linux

Release date

Exploit published date

2008-06-18

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
_   _ _____ _     ___ _____ _   _
                   / / / / ____/ /   /  _/_  __/ / / /
                  / /_/ / __/ / /    / /  / / / /_/ /
                 / __  / /___/ /____/ /  / / / __  /
                /_/ /_/_____/_____/___/ /_/ /_/ /_/
                           Helith - 0815
--------------------------------------------------------------------------------

Author		 : Rembrandt
Date		 : 2007-06-03
Affected Software: screen <= 4.0.3
Affected OS	 : OpenBSD up to 4.4 (and propably others)
Type		 : Local Authentication Bypass

OSVDB		 : 39587
Milw0rm		 : 4028
CVE		 : 2007-3048
ISS X-Force:	 : 34693

screen, on some operating systems, is vulnerable to a local terminal screen 
lock authentication bypass that may allow physically proximate attackers to 
gain access to the system.

This issue has been confirmed on OpenBSD with screen 4.0.3 on x86/amd64.
The underlying vulnerability may be related to 3rd party authentication such
as PAM. This issue was tested on OpenSuSE with screen 4.0.2 and was not
vulnerable.


Steps to reproduce:

$ screen -S test
[Screened session starts]
$ id
uid=1001(test) gid=1001(test) groups=1001(test)
$ 
[type  ctrl-a x]
Key:  test
Again:  test
Screen used by test <test>.
Password:
[type  ctrl-c]
$ screen -r
[Regained access to screen, without password]

The screen lock mechanism is designed to lock a terminal, not the entire shell 
session. If an attacker has shell access to the target account, it is understood
they can bypass protection. However, on the system tested, the screen lock
mechanism was bypassed using 'ctrl-c'.

The vulnerability is not in OpenBSD. screen developers indicate this is known
behavior, but do not appear to fully understand the scenario with which 
this can be abused. Replies to my initial disclosure suggest this may be
related to PAM authentication, or another 3rd party package. Testing was
not performed to fully identify the vulnerable code.

Tobias Ulmer has committed a patch to the screen code that prevents
this exploit from happening.


Kind regards,
Rembrandt

# milw0rm.com [2008-06-18]
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-11-27 "libupnp 1.6.18 - Stack-based buffer overflow (DoS)" dos linux "Patrik Lantz"
2020-11-24 "ZeroShell 3.9.0 - 'cgi-bin/kerbynet' Remote Root Command Injection (Metasploit)" webapps linux "Giuseppe Fuggiano"
2020-10-28 "Blueman < 2.1.4 - Local Privilege Escalation" local linux "Vaisha Bernard"
2020-10-28 "Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion" webapps linux "Ivo Palazzolo"
2020-10-28 "PackageKit < 1.1.13 - File Existence Disclosure" local linux "Vaisha Bernard"
2020-10-28 "aptdaemon < 1.1.1 - File Existence Disclosure" local linux "Vaisha Bernard"
2020-09-11 "Gnome Fonts Viewer 3.34.0 - Heap Corruption" local linux "Cody Winkler"
2020-07-10 "Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution" remote linux SpicyItalian
2020-07-06 "Grafana 7.0.1 - Denial of Service (PoC)" dos linux mostwanted002
Release Date Title Type Platform Author
2009-04-30 "Multiple Vendor - PF Null Pointer Dereference" dos bsd Rembrandt
2009-04-13 "OpenBSD 4.5 - IP datagrams Remote Denial of Service" dos openbsd Rembrandt
2009-02-09 "NETGEAR SSL312 Router - Denial of Service" dos hardware Rembrandt
2008-06-18 "Screen 4.0.3 (OpenBSD) - Local Authentication Bypass" local linux Rembrandt 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected