Overland Guardian OS 5.1.041 privilege escalation

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Overland Guardian OS 5.1.041 privilege escalation
# Published : 2009-10-20
# Author : trompele
# Previous Title : GPG2/Kleopatra 2.0.11 malformed certificate PoC
# Next Title : South River Technologies WebDrive Service privilege escalation

Device: Snap Server 410
OS: GuardianOS 5.1.041
Description: When logged in to CLI via ssh as admin (uid=1) you can escalate your privileges to uid 0 and get /bin/sh. In order to achieve this open 'less' which is available as default for viewing files (ie. less /tmp/top.log) and type in '!/bin/sh'. This will give you direct access to sh shell with UID 0. Tested only on OS version as above.