RedStar 3.0 Desktop - Privilege Escalation (Software Manager - swmng.app) Vulnerability

The root user is disabled on Red Star, and it doesn't look like there is a way to enable it.
UnFortunately, they left a big security hole: the Software Manager (swmng.app),
which runs as root through sudo and will install any RPM package, even if unsigned.
 
To get root, get this RPM package I made into Red Star through an ISO (if you're using a virtual machine) or USB key,
double-click it to open it with the Software Manager, and click through the blue buttons until it’s done.
After that, run rootsh to get a root shell.
Being a RedHat-based system (hinting on Fedora 15), SELinux will prevent you from doing some things,
but disabling it is a matter of running setenforce 0 as root.
 
 
Download: https://mega.co.nz/#!jgBT0RxZ!LQDEBBrbGxE6fag4d_A2C2cWj2PSNR_ZvnSW_UjRD5E
Mirror: http://www.exploit-db.com/sploits/redstarroot.rpm
 
 
## Source: http://richardg867.wordpress.com/2015/01/01/notes-on-red-star-os-3-0/ & http://www.openwall.com/lists/oss-security/2015/01/09/1

#  0day.today [2018-03-12]  #