This happens on f5 appliances: the tomcat user can upload files to /shared/images , then this root process periodically scans the directory looking for firmware. Shell expansion causes privesc here :p
Also, there are no csrf tokens in the firmware upload form. vdbs can go wild now :p On Sat, Jun 28, 2014 at 11:29 PM, Daniel Miller <[email protected]> wrote: > On Sat, Jun 28, 2014 at 5:06 AM, fulldisclosure < > [email protected]> wrote: > > > to be honest, bash shouldn't expand * to "file1 file2 file3 -rf..." it > > should do it to " 'file1' 'file2' 'file3' '\-rf'..." instead, with all > > meta chars escaped properly. > > > > But this breaks my directory metadata scheme: important directories contain > a file named "-i", unimportant ones have "-f". > > _______________________________________________ > Sent through the Full Disclosure mailing list > http://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ > _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
