Exploitation Summary
EIP tracks 3 public exploits for CVE-2000-1125. PoCs published by Tlabs, anonymous, fish.
AI-analyzed exploit summary This exploit targets CVE-2000-1125, leveraging environment variable manipulation in Red Hat Linux 6.2's dump/restore utilities to execute arbitrary code with root privileges. It compiles a SUID shell and uses a malicious 'hey' script to escalate privileges.
Description
restore 0.4b15 and earlier in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program.
Exploits (3)
This exploit targets CVE-2000-1125, leveraging environment variable manipulation in Red Hat Linux 6.2's dump/restore utilities to execute arbitrary code with root privileges. It compiles a SUID shell and uses a malicious 'hey' script to escalate privileges.
This exploit leverages a vulnerability in the /sbin/restore command on Red Hat 6.2 systems to execute arbitrary commands as root. It creates a script that copies /bin/sh to the user's home directory and sets the SUID bit, allowing privilege escalation.
This exploit leverages a vulnerability in the 'restore' program (version 0.4b15) distributed with RedHat Linux 6.2, where the RSH environment variable is used to execute arbitrary code with elevated privileges (EUID 0). The script compiles a C program to spawn a root shell and manipulates the RSH variable to execute a script that sets the SUID bit on the compiled binary.