full-disclosure - ** FreeBSD local r00t zeroday

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 1 Dec 2009 20:55:53 +0100
From: Michał Manterys <michal.manterys@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject:  ** FreeBSD local r00t zeroday

http://lists.grok.org.uk/pipermail/full-disclosure/2009-November/071689.html

$ uname -a
FreeBSD serev1.domena.pl 7.2-STABLE FreeBSD 7.2-STABLE #1: Tue Dec  1
19:42:43 CET 2009     root@...ver1.domena.pl:/usr/src/sys/i386/compile/kern1
i386
$ ./test.sh
env env.c program.c program.o test.sh w00t.so.1.0 FreeBSD local r00t zeroday
by Kingcope
November 2009
env.c: In function 'main':
env.c:5: warning: incompatible implicit declaration of built-in function
'malloc'
env.c:9: warning: incompatible implicit declaration of built-in function
'strcpy'
env.c:11: warning: incompatible implicit declaration of built-in function
'execl'
/libexec/ld-elf.so.1: environment corrupt; missing value for
/libexec/ld-elf.so.1: environment corrupt; missing value for
/libexec/ld-elf.so.1: environment corrupt; missing value for
/libexec/ld-elf.so.1: environment corrupt; missing value for
/libexec/ld-elf.so.1: environment corrupt; missing value for
/libexec/ld-elf.so.1: environment corrupt; missing value for
ALEX-ALEX
#id -a
uid=1018(user) gid=1018(user) euid=0(root) groups=1018(user)

Install patch:
cd /usr/src/libexec/rtld-elf
fetch http://wojciech.sychut.eu/rtld.patch
patch < rtld.patch
make clean
make
make install


and:

$ ./test.sh
env env.c program.c program.o test.sh w00t.so.1.0 FreeBSD local r00t zeroday
by Kingcope
November 2009
env.c: In function 'main':
env.c:5: warning: incompatible implicit declaration of built-in function
'malloc'
env.c:9: warning: incompatible implicit declaration of built-in function
'strcpy'
env.c:11: warning: incompatible implicit declaration of built-in function
'execl'
/libexec/ld-elf.so.1: environment corrupt; missing value for
/libexec/ld-elf.so.1: environment corrupt; missing value for
/libexec/ld-elf.so.1: environment corrupt; missing value for
/libexec/ld-elf.so.1: environment corrupt; missing value for
/libexec/ld-elf.so.1: environment corrupt; missing value for
/libexec/ld-elf.so.1: environment corrupt; missing value for
ALEX-ALEX
#id -a
uid=1018(user) gid=1018(user) euid=0(root) groups=1018(user)

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/