Rapid7 Vulnerability & Exploit Database

Solaris 'EXTREMEPARR' dtappgather Privilege Escalation

Back to Search

Solaris 'EXTREMEPARR' dtappgather Privilege Escalation

Disclosed
04/24/2017
Created
03/19/2019

Description

This module exploits a directory traversal vulnerability in the `dtappgather` executable included with Common Desktop Environment (CDE) on unpatched Solaris systems prior to Solaris 10u11 which allows users to gain root privileges. dtappgather allows users to create a user-owned directory at any location on the filesystem using the `DTUSERSESSION` environment variable. This module creates a directory in `/usr/lib/locale`, writes a shared object to the directory, and runs the specified SUID binary with the shared object loaded using the `LC_TIME` environment variable. This module has been tested successfully on: Solaris 9u7 (09/04) (x86); Solaris 10u1 (01/06) (x86); Solaris 10u2 (06/06) (x86); Solaris 10u4 (08/07) (x86); Solaris 10u8 (10/09) (x86); Solaris 10u9 (09/10) (x86).

Author(s)

  • Shadow Brokers
  • Hacker Fantastic
  • bcoles <bcoles@gmail.com>

Platform

Solaris,Unix

Architectures

x86, x64, sparc

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/solaris/local/extremeparr_dtappgather_priv_esc
msf exploit(extremeparr_dtappgather_priv_esc) > show targets
    ...targets...
msf exploit(extremeparr_dtappgather_priv_esc) > set TARGET < target-id >
msf exploit(extremeparr_dtappgather_priv_esc) > show options
    ...show and set options...
msf exploit(extremeparr_dtappgather_priv_esc) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;