diff --git a/mobileiron0day.txt b/mobileiron0day.txt index adc63e1..4461750 100755 --- a/mobileiron0day.txt +++ b/mobileiron0day.txt @@ -15,7 +15,7 @@ miadmin 13353 0.0 0.0 63856 1388 pts/1 S+ 14:45 0:00 /bin/bash /mi/b root 13399 0.0 0.0 104096 2144 pts/1 S+ 14:45 0:00 /usr/bin/sudo /usr/bin/less mylnk root 13400 0.0 0.0 63600 1024 pts/1 S+ 14:45 0:00 /usr/bin/less mylnk -The above command can be triggered from the miadmin user with the "show log" functoinality, +The above command can be triggered from the miadmin user with the "show log" functionality, as "/usr/bin/less" is then called with root privileges it is possible to quickly elevate privileges to root using !sh as seen in the example here: @@ -41,7 +41,7 @@ vsp@hostname.victim> As less supports the ability of executing arbitrary commands and piping input it is trivial to gain arbitrary command execution by using pipe with the current file "|m." which will change the less prompt to "!" indicating which program to pipe to and then typing /bin/sh -c "CMD YOU WANT" -to be able to execute arbitrary commands with root privileges. You will recieve the command +to be able to execute arbitrary commands with root privileges. You will receive the command output. --log 'mi.log' --