1. 2
    Holey Beep (CVE-2018-0492) satire security holeybeep.ninja
    varjag avatar via varjag 4 months ago | cached | 3 comments

  1.  

  2. 4
    sebboh avatar sebboh 4 months ago | link

    The beep.patch file contains calls to exec (the ! command). Applying the patch RUNS code.

    1. 1
      Mex avatar Mex 4 months ago | link

      Can you go into more details on this? What does it run?

      1. 2
        sebboh avatar sebboh 4 months ago | link

        I recommend viewing it for yourself of course, but for your convenience:

        https://github.com/holeybeep/holeybeep/blob/e971461c5b4a12d3291b6553af8872a740d70f01/beep.patch#L62

        !id>~/pwn.lol;beep

        id prints information about the uid and gids of the current process. >~/pwn.lol directs that output to a file in your home directory (or some home directory, depending on how you run this). Then beep emits a beep.

        That patch is able to execute arbitrary commands was discussed here recently.