【CVE-2021-3156】linux sudo提权复现及补丁修复

最新推荐文章于 2024-06-01 21:43:54 发布

原创

最新推荐文章于 2024-06-01 21:43:54 发布 · 4.2k 阅读

6 ·

CC 4.0 BY-SA版权

前言

今天安全圈都在刷屏【CVE-2021-3156】这个漏洞，由于这是一个缓冲区溢出漏洞，通用性比较强，因此也跟风实验一下，详细复现及修复过程如下。

一、实验环境

操作系统：kali-linux-2020.1b

1、adduser命令新建一个低权限用户

root@kali:~# adduser test
Adding user `test' ...
Adding new group `test' (1001) ...
Adding new user `test' (1001) with group `test' ...
Creating home directory `/home/test' ...
Copying files from `/etc/skel' ...
New password: 
Retype new password: 
passwd: password updated successfully
Changing the user information for test
Enter the new value, or press ENTER for the default
	Full Name []: 
	Room Number []: 
	Work Phone []: 
	Home Phone []: 
	Other []: 
Is the information correct? [Y/n]

2、/etc/sudoers添加记录

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification