Exploitation Summary
EIP tracks 2 public exploits for CVE-2002-2040. PoCs published by badc0ded.
AI-analyzed exploit summary This exploit leverages a privilege escalation vulnerability in the QNX phgrafx-startup utility due to unsafe use of the system() function. It creates a malicious crttrap script in /tmp, modifies the PATH to prioritize it, and triggers phgrafx-startup to execute the script with elevated privileges, resulting in a setuid root shell.
Description
The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do not properly drop privileges before executing the system command, which allows local users to execute arbitrary commands by modifying the PATH environment variable to reference a malicious crttrap program.
Exploits (2)
This exploit leverages a privilege escalation vulnerability in the QNX phgrafx-startup utility due to unsafe use of the system() function. It creates a malicious crttrap script in /tmp, modifies the PATH to prioritize it, and triggers phgrafx-startup to execute the script with elevated privileges, resulting in a setuid root shell.
This exploit leverages a privilege escalation vulnerability in the QNX phgrafx utility by hijacking the PATH environment variable to execute a malicious script (crttrap) with root privileges. The script creates a setuid root shell in /tmp/badc0ded.