CVE-2014-0476
chkrootkit < 0.50 - Local Privilege Escalation via Trojan Horse Executable
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2014-0476.
PoCs published by Metasploit, Thomas Stangner, Thomas Stangner, Julien, Voisin, including Metasploit module exploits/unix/local/chkrootkit.
AI-analyzed exploit summary This Metasploit module exploits CVE-2014-0476 in Chkrootkit by placing a malicious executable at /tmp/update, which is executed as root during the next scheduled scan. The exploit leverages a cron job to escalate privileges.
Description
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.
Exploits (3)
This Metasploit module exploits CVE-2014-0476 in Chkrootkit by placing a malicious executable at /tmp/update, which is executed as root during the next scheduled scan. The exploit leverages a cron job to escalate privileges.
The vulnerability in chkrootkit's slapper() function allows local attackers to execute arbitrary code as root due to unquoted variable assignment. An attacker can exploit this by placing a malicious executable in /tmp, which gets executed when chkrootkit runs.
This Metasploit module exploits a privilege escalation vulnerability in Chkrootkit before 0.50 by placing an executable named '/tmp/update' that is executed as root during a scheduled scan. The exploit waits for the cron job to trigger the payload.