From: Christoph Bussenius (pepe-bugtraq@pepe.is-a-geek.org)
Date: Mon Feb 26 2007 - 07:51:04 EST
Hi John,
On Sat, Feb 24, 2007 at 11:52:49AM -0700, John McGuire wrote:
> When I run the app as a non-root user, I get a /bin/sh prompt with
> that users perms, not roots. I modified this program a bit to take an
> argument off the command line and passed it `whoami`. This returned
> root as the response. /bin/sh however belongs to the lower priv user.
Bash resets its effective uid to the real uid unless you give it the -p
switch. This will work:
#include <stdio.h>
int main() {
char *arr[3];
arr[0] = "/bin/sh";
arr[1] = "-p";
arr[2] = NULL;
execve (arr[0], arr, NULL);
}
Regards,
Christoph
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:36 EDT