Comments (8)
A single binary needs some rewriting, because it requires a directory (which can be created by the binary) a library (which must then wirtten and compiled by the binary using system or similar methods).
Otherwise we can just create another process, execute true
and check if the return code is different from zero.
The whoami tactic is probably a little easier to code, let me know if you require this to be a single binary and if the binary can compile stuff (otherwise we can just pack the stage1 and the library in a single dezipping loader).
from cve-2021-4034.
@berdav
thanks for the reply.
One single binary and run "whoami" return 1 when hacked approach will be very helpful for CM tool like saltstack/ansible.
We can then use this for detection and verification purpose.
from cve-2021-4034.
- I tested the dry-run branch on a ubuntu 18.04 and it worked as expected to return 1 error code when rooted the system.
me@ubuntu18t03:~/github/CVE-2021-4034/dry-run$ ./dry-run-cve-2021-4034
root
me@ubuntu18t03:~/github/CVE-2021-4034/dry-run$ echo $?
1
me@ubuntu18t03:~/github/CVE-2021-4034/dry-run$
- but on a centos 7 , I ran into compiling issue.
I will try to use binary from ubuntu 18 to test C7 system.
[me@centos7t01 CVE-2021-4034]$ make dry-run
make -C dry-run
make[1]: Entering directory `/home/me/github/CVE-2021-4034/dry-run'
cc -Wall -DTRUE='"/usr/bin/true"' -DWHOAMI='"/usr/bin/whoami"' --shared -o pwnkit-dry-run.so pwnkit-dry-run.c
/usr/bin/ld: /tmp/ccVUUTUM.o: relocation R_X86_64_32S against `.rodata' can not be used when making a shared object; recompile with -fPIC
/usr/bin/ld: final link failed: Nonrepresentable section on output
collect2: error: ld returned 1 exit status
make[1]: *** [pwnkit-dry-run.so] Error 1
make[1]: Leaving directory `/home/me/github/CVE-2021-4034/dry-run'
make: *** [dry-run] Error 2
[me@centos7t01 CVE-2021-4034]$
from cve-2021-4034.
oops! You're right. I had missed the -fPIC compilation flag π also there was a problem in the code with old compilers default beaviour.
I've added it to the branch. Can you retest it?
Merging into main.
from cve-2021-4034.
- "make dry-run" compilation on centos 7 and ubuntu 18 all fine.
- ./dry-run/dry-run-cve-2021-4034 work as expected.
- please close this issue.
from cve-2021-4034.
or after rooting the OS , only run a whoami command then return the username and exit the program?
Goal is to have one exe binary not shell script.
from cve-2021-4034.
I've pushed a branch issue-14-dry-run with a fix of what you're asking for.
You need to compile it with make dry-run
and then execute the binary in the dry-run directory.
I've tested it, if it is what you intended I will merge it into the main branch.
from cve-2021-4034.
dry-run-cve-2021-4034 binary created on ubuntu 18 was able to run on centos 7. Pls consider merging this branch into main.
from cve-2021-4034.
Related Issues (19)
- /bin/true or /usr/bin/true
- Not working on raspbian HOT 2
- License Request HOT 2
- Root HOT 2
- Problem with conversion HOT 5
- 1
- cannot stat '/usr/bin/true': No such file or directory HOT 4
- doesn't do anything
- Cannot convert messageοΌ
- exploit gets killed
- need a bit more info HOT 5
- how to use username instead of uid ? HOT 1
- close and delete this
- Is this error build or not compatible ?
- /bin/sh: 0: Illegal option -p HOT 3
- Not work HOT 2
- Doesn't do anything
- The value for the SHELL variable was not found the /etc/shells file HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cve-2021-4034.