Exploitation Summary
EIP tracks 4 public exploits for CVE-2002-0137. PoCs published by Karol Wiesek, anonymous, atomi.
AI-analyzed exploit summary This exploit leverages a symbolic link attack in CDRDAO (setuid root) to overwrite /etc/ld.so.preload, enabling arbitrary command execution as root via a malicious shared library. It creates a setuid shell for privilege escalation.
Description
CDRDAO 1.1.4 and 1.1.5 allows local users to overwrite arbitrary files via a symlink attack on the $HOME/.cdrdao configuration file.
Exploits (4)
This exploit leverages a symbolic link attack in CDRDAO (setuid root) to overwrite /etc/ld.so.preload, enabling arbitrary command execution as root via a malicious shared library. It creates a setuid shell for privilege escalation.
This exploit leverages a symbolic link vulnerability in CDRDAO (CVE-2002-0137) to overwrite root-owned files, specifically targeting /etc/ld.so.preload to achieve local privilege escalation. It compiles a shared library to hook getuid() and a shell program to spawn a root shell.
This exploit leverages a symbolic link vulnerability in CDRDAO (setuid root) to overwrite root-owned files, specifically creating a cron job that compiles and executes a setuid root shell. The attack involves manipulating the .cdrdao configuration file to achieve local privilege escalation.
This exploit leverages a symbolic link vulnerability in CDRDAO (setuid root) to overwrite root-owned files or execute commands as root. It creates a malicious .toc file and uses cdrdao's show-data command to read arbitrary files, demonstrating the vulnerability.