Sploitus

TrueCrypt <= 4.3 Local Privilege Escalation Exploit

CVE-2007-1738CVE-2007-1589CVE-2007-1738

seebug · 2007-04-10

Exploit Code

MARKDOWN20 lines
## https://sploitus.com/exploit?id=SSV:6613
#&nbsp;$Id:&nbsp;raptor_truecrypt,v&nbsp;1.1.1.1&nbsp;2007/04/04&nbsp;11:31:56&nbsp;raptor&nbsp;Exp&nbsp;$
#
#&nbsp;raptor_truecrypt&nbsp;-&nbsp;setuid&nbsp;truecrypt&nbsp;privilege&nbsp;escalation
#&nbsp;Copyright&nbsp;(c)&nbsp;2007&nbsp;Marco&nbsp;Ivaldi&nbsp;&lt;raptor@0xdeadbeef.info&gt;
#
#&nbsp;TrueCrypt&nbsp;4.3,&nbsp;when&nbsp;installed&nbsp;setuid&nbsp;root,&nbsp;allows&nbsp;local&nbsp;users&nbsp;to&nbsp;cause&nbsp;a&nbsp;
#&nbsp;denial&nbsp;of&nbsp;service&nbsp;(filesystem&nbsp;unavailability)&nbsp;or&nbsp;gain&nbsp;privileges&nbsp;by&nbsp;mounting&nbsp;
#&nbsp;a&nbsp;crafted&nbsp;TrueCrypt&nbsp;volume,&nbsp;as&nbsp;demonstrated&nbsp;using&nbsp;(1)&nbsp;/usr/bin&nbsp;or&nbsp;(2)&nbsp;another
#&nbsp;user's&nbsp;home&nbsp;directory,&nbsp;a&nbsp;different&nbsp;issue&nbsp;than&nbsp;CVE-2007-1589&nbsp;(CVE-2007-1738).
#
#&nbsp;WARNING:&nbsp;THIS&nbsp;IS&nbsp;A&nbsp;PROOF&nbsp;OF&nbsp;CONCEPT&nbsp;EXPLOIT&nbsp;TAKING&nbsp;ADVANTAGE&nbsp;OF&nbsp;NPTL&nbsp;THREAD
#&nbsp;LOCAL&nbsp;STORAGE&nbsp;DYNAMIC&nbsp;LINKING&nbsp;MODEL,&nbsp;DO&nbsp;NOT&nbsp;USE&nbsp;IT&nbsp;IF&nbsp;YOU&nbsp;DON'T&nbsp;KNOW&nbsp;HOW&nbsp;IT
#&nbsp;WORKS!&nbsp;YEAH,&nbsp;IT&nbsp;*DOES*&nbsp;REQUIRE&nbsp;SOME&nbsp;TWEAKINGS&nbsp;TO&nbsp;EXPLOIT&nbsp;NON-TLS&nbsp;PLATFORMS!
#
#&nbsp;Other&nbsp;possible&nbsp;attack&nbsp;vectors:&nbsp;/etc/cron.{d,hourly,daily,weekly,monthly},&nbsp;at&nbsp;
#&nbsp;(/var/spool/atjobs/),&nbsp;xinetd&nbsp;(/etc/xinetd.d),&nbsp;/etc/logrotate.d,&nbsp;and&nbsp;more...

http://www.0xdeadbeef.info/exploits/raptor_truecrypt.tgz
http://www.milw0rm.com/sploits/04042007-raptor_truecrypt.tgz