BrainFuck Programming Tutorial by: Katie
|# Connects to servers vulnerable to CVE-2014-0160 and looks for cookies, specifically user sessions.|
|# Michael Davis (firstname.lastname@example.org)|
|# Based almost entirely on the quick and dirty demonstration of CVE-2014-0160 by Jared Stafford (email@example.com)|
|# The author disclaims copyright to this source code.|
|Author: takeshix <firstname.lastname@example.org>|
|PoC code for CVE-2014-0160. Original PoC by Jared Stafford (email@example.com).|
|Supportes all versions of TLS and has STARTTLS support for SMTP,POP3,IMAP,FTP and XMPP.|
|from argparse import ArgumentParser|
Let's say somebody temporarily got root access to your system, whether because you "temporarily" gave them sudo rights, they guessed your password, or any other way. Even if you can disable their original method of accessing root, there's an infinite number of dirty tricks they can use to easily get it back in the future.
While the obvious tricks are easy to spot, like adding an entry to /root/.ssh/authorized_keys, or creating a new user, potentially via running malware, or via a cron job. I recently came across a rather subtle one that doesn't require changing any code, but instead exploits a standard feature of Linux user permissions system called setuid to subtly allow them to execute a root shell from any user account from the system (including
www-data, which you might not even know if compromised).
If the "setuid bit" (or flag, or permission mode) is set for executable, the operating system will run not as the cur