RedStar 3.0 Desktop – ‘Software Manager swmng.app’ Local Privilege Escalation

• Exploit Database
• 133 阅读

• 作者： RichardG
  日期： 2015-01-11
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/35749/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

  The root user is disabled on Red Star, and it doesn't look like there is a way to enable it. UnFortunately, they left a big security hole: the Software Manager (swmng.app), which runs as root through sudo and will install any RPM package, even if unsigned.   To get root, get this RPM package I made into Red Star through an ISO (if you're using a virtual machine) or USB key, double-click it to open it with the Software Manager, and click through the blue buttons until it’s done. After that, run rootsh to get a root shell. Being a RedHat-based system (hinting on Fedora 15), SELinux will prevent you from doing some things, but disabling it is a matter of running setenforce 0 as root.     Download: https://mega.co.nz/#!jgBT0RxZ!LQDEBBrbGxE6fag4d_A2C2cWj2PSNR_ZvnSW_UjRD5E Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35749.rpm (redstarroot.rpm)     ## Source: http://richardg867.wordpress.com/2015/01/01/notes-on-red-star-os-3-0/ & http://www.openwall.com/lists/oss-security/2015/01/09/1