Hack Forums
GameCP 0day local root exploit - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: GameCP 0day local root exploit (/showthread.php?tid=3263897)



GameCP 0day local root exploit - Starfall - Feb 16, 2013

Code
<Starfall> Hi, are any GameCP coders here? I'd like to discuss a sensitive issue.
<Starfall> okay, sorry but i gotta do this
<Starfall> Billy N00kstrr Uf0 Adzgibbo|H Archey brayden_ Clinton Daniel0 davidbanham Jackster_ William|i7
<Jackster_> Grow up
<Jackster_> Need to talk to staff then email
<Jackster_> don't come here spaming
<Starfall> a single line is spamming, makes perfect sense
<Starfall> get over yourself, I'm trying to help fix an exploitable bug but you just fucked it up for everybody
<Starfall> now it's going on Full Disclosurre
<Jackster_> Then email support
<Starfall> nope, too late, the skiddies get it now
<Jackster_> right...
<Starfall> IRC is supposed to be a more immediate support channel, and I figured that due to the nature of the issue I should try here first. Is there a problem with that?
<Jackster_> Sunday night
<Starfall> I said, is there a problem with that? Not "what day is it"
<Starfall> You have one hell of an attitude towards people trying to help, and I sincerely hope you're not on the GCP support team.
<Jackster_> Sunday night as in the staff are not in the office
<Jackster_> You are not asking for support
<Starfall> I am asking them to fix an issue, is that not support?
<Jackster_> if you have found a problem then either email support or add it to the bugs.gamecp.com
<Starfall> Due to many spammers abusing our bugs system we have temporarily disabled it while we increase spam prevention.
<Starfall> If you have a bug email it to [email protected]
<Starfall> I've already sent one email by the way. Stop being such a stuck up asshole when someone wants to fix something.
<Starfall> I'm emailing FD now, have fun cleaning up the mess.
<Jackster_> oh grow up kiddo
This exploit is simple. You create a plugin for whatever game is running on the panel that creates a symlink to /etc/shadow, use the built in file manager to edit the symlink and change root's password and log in. Game over.
There is no need for a POC here. Instructions are detailed enough. The spoiler below is just a silly, slightly-relevant thing.

Oh and by the way, Jackster got banned from that IRC about 2 hours later for being an asshole and impersonating staff.
This is the last time I ever try to whitehat anything, even boring worn-out bugs like this one.
Spoiler (Click to View)





* - ‌Hycca - Feb 16, 2013

Why did you delete your thread and re-post it? But nice 0day bby.


* - LevelUp - Feb 16, 2013

Did you not already post this earlier?

Nevertheless, fuck whitehat shit. You tried to do the right thing and this happens.

Also I didn't know you played WoW?


* - Starfall - Feb 16, 2013

(Feb 16, 2013 03:08 PM)‌Hawkode Wrote:  Why did you delete your thread and re-post it? But nice 0day bby.

I didn't. Paradoxum did because you guys couldn't stay on topic.


* - Phizo - Feb 16, 2013

Nice job finding this.
Jackster is gay.


* - Light Yagami. - Feb 16, 2013

Nice job finding this starfall and sorry you had to repost it.


* - Gpure - Feb 16, 2013

I like the idea to white-hat it, but you did the right thing if the security team won't respond to a serious bug.


* - Jack Bauer - Feb 16, 2013

Good job dude! :) its nice to have people like you. :D


* - Starfall - Feb 16, 2013

(Feb 16, 2013 06:37 PM)Gpure Wrote:  I like the idea to white-hat it, but you did the right thing if the security team won't respond to a serious bug.
I used to only whitehat stuff I didnt care about anymore.
Now, I whitehat nothing, because fuck you.


* - Dyme - Feb 16, 2013

Thanks ball of star I will use dis to own as many gibsons possible.