Analysis of files in locale.tgz

locale.tgz is a collection of local privilege escalation tools. It untars to give the following:

• sploitz - directory 
• sxp - a ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), not stripped 
• sxp.c - source file

sploitz is a directory and it contains the following: 

• epc - a ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), not stripped
• epcs2.c - source file 
• modu.sh - shell script 
• ptr - a ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), not stripped 
• ptrace24.c - C file 
• su - a ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), not stripped 
• su.c - source file sxp - a ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), not stripped 
• sxp.c - source file 
• xperl.sh -shellscript

We notice that there are identical files with the same filename 

• sxp (in both ./ and ./sploitz)
• and sxp.c (in both ./ and ./sploitz). 

A md5sum check confirms that both sxp binaries are the same. Both copies of sxp.c are the same except for differences in the comment at line 32 column 38. This is best shown with a diff -a sxp.c spliotz/spx.c.

Comments in sxp.c clearly shows that its an exploit that give the user root account when run on system with sendmail version 8.11.6 and below.

epcs2.c is a ptrace race condition exploit that gives root privilege on kernel 2.2.18 and below. epc is the binary complied from epcs2.c

modu.sh is a RedHat 7.0 modutils exploit.

ptrace24.c is a execve/ptrace race condition exploit for Linux Kernel up to 2.4.9. ptr is the binary complied from ptrace24.c

xperl.sh is an exploit for suidperl mail shell escape vulnerability. The SUID version of perl sends email in response to a race condition in file system and the sendmail program allows embedded commands in emails. More can be found at http://ee.tamu.edu/~reddy/ee602_00/mike.pdf.

su.c is a format string exploit that gives the user root privileges.

md5sum hashes of su.c and epcs2.c are the same as those downloaded from the Internet, i.e.. http://www.bhsecurity.com.