CVE-2017-3631

Related Files

Solaris RSH Stack Clash Privilege Escalation

Posted Oct 15, 2018

Authored by Brendan Coles, Qualys Security Advisory | Site metasploit.com

This Metasploit module exploits a vulnerability in RSH on unpatched Solaris systems which allows users to gain root privileges. The stack guard page on unpatched Solaris systems is of insufficient size to prevent collisions between the stack and heap memory, aka Stack Clash. This Metasploit module uploads and executes Qualys' Solaris_rsh.c exploit, which exploits a vulnerability in RSH to bypass the stack guard page to write to the stack and create a SUID root shell. This Metasploit module has offsets for Solaris versions 11.1 (x86) and Solaris 11.3 (x86). Exploitation will usually complete within a few minutes using the default number of worker threads (10). Occasionally, exploitation will fail. If the target system is vulnerable, usually re-running the exploit will be successful. This Metasploit module has been tested successfully on Solaris 11.1 (x86) and Solaris 11.3 (x86).

tags | exploit, shell, x86, root

systems | solaris

advisories | CVE-2017-1000364, CVE-2017-3629, CVE-2017-3630, CVE-2017-3631

SHA-256 | 1e59da07b25c5d7ed7f7081baca4d6ef68b592b7e64e01af24769ec5d101e1a3

Download | Favorite | View

Oracle Solaris 11.1 / 11.3 rsh Stack Clash Privilege Escalation

Posted Jun 29, 2017

Site qualys.com

Oracle Solaris versions 11.1 and 11.3 rsh local privilege escalation stack clash exploit.

tags | exploit, local

systems | solaris

advisories | CVE-2017-3629, CVE-2017-3630, CVE-2017-3631

SHA-256 | d6fc2124ab39b596a408ba197a8da71c03b284c1dac54ac107cc4d471c892d32

Download | Favorite | View