DirectAdmin 1.33.6 – Symlink Security Bypass

• Exploit Database
• 39 阅读

• 作者： alnjm33
  日期： 2010-01-06
• 类别：

  • local
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/11029/

• Subject: DirectAdmin <= 1.33.6 Symlink Permission Bypass
  Date: 5/1/21010
  Author: alnjm33
  Tested on: 1.33.6 -- 1.33.1 and i think it's work in all versions
  Home:sec-war.com
  :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::exploit::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
  first
  must execute this command on the server >>>> ln /etc/shadow
  to make symbolic link to shadow file in any dir
  after that go to
  Create/Restore Backups in direct and make
  ((Domains Directory: Backs up))
  the backup file will be in
  /home/test/backups
  go there then Extract tar.gz file
  after extract
  go to
  /home/test/backups/domains/test.com/public_html
  or the dir which you execute the command
  and now you can read the shadow file which have 400 Permission
  
  Greetz to :PrEdAtOr -Sh0ot3R - xXx - Mu$L!m-h4ck3r - ahmadso -JaMbA-RoOt_EgY-jago-dz-XR57 all sec-war.com members<http://sec-war.com/cc//index.php?showuser=36>