[Dyme]

Code:

/etc/cron.daily:
total 108
-rwxr-xr-x   1 root root  2032 Jun  4  2014 chkrootkit

You could be very lucky here. Check what version of chkrootkit this is... if it's < 0.50 then popping root is pretty trivial: http://www.exploit-db.com/exploits/33899/

I'm a little discouraged that the timestamp is 6/4/14, as that is also the day that 0.50 was released. Nevertheless, it's worth checking out.

This may work for you http://www.exploit-db.com/exploits/18411/

Ahh no problem I just skimed over it and saw the kernel version, shame that it doesn't work, have you thought about shellcode?

Lol mayne I'm sorry but this is all just so not right.

[Reiko]

You could be very lucky here. Check what version of chkrootkit this is... if it's < 0.50 then popping root is pretty trivial: http://www.exploit-db.com/exploits/33899/

I had to use that one yesterday morning. Works great assuming chkrootkit is the vuln version.

[Dyme]

I had to use that one yesterday morning. Works great assuming chkrootkit is the vuln version.

I have yet to run into it, but the situation is perfectly plausible and the vuln is so easily exploited. I love privilege escalation vulns like this as you probably already know lmao.

[Reiko]

I have yet to run into it, but the situation is perfectly plausible and the vuln is so easily exploited. I love privilege escalation vulns like this as you probably already know lmao.

Dude, the trend now is to patch the vulns on the news and nothing else. SSL bugs, kernel bugs, GHOST are ALWAYS patched/mitigated. Anything else? Wide open.

[whatever]

You could be very lucky here. Check what version of chkrootkit this is... if it's < 0.50 then popping root is pretty trivial: http://www.exploit-db.com/exploits/33899/

I'm a little discouraged that the timestamp is 6/4/14, as that is also the day that 0.50 was released. Nevertheless, it's worth checking out.



Lol mayne I'm sorry but this is all just so not right.

I fucking love you man, the version is 0.49. Thanks for the help.

[Dyme]

I fucking love you man, the version is 0.49. Thanks for the help.

ayyyy must be the moneyyy

[Sans]

haha.. pretty funny an anti rootkit sw has a root hole in it