cve2018 linux内核提权漏洞,CVE-2019-13272 Linux 内核提权 +cve-2018-18955

Ubuntu 16.04.5 kernel 4.15.0-29-generic

Ubuntu 18.04.1 kernel 4.15.0-20-generic

Ubuntu 19.04 kernel 5.0.0-15-generic

Ubuntu Mate 18.04.2 kernel 4.18.0-15-generic

Linux Mint 19 kernel 4.15.0-20-generic

Xubuntu 16.04.4 kernel 4.13.0-36-generic

ElementaryOS 0.4.1 4.8.0-52-generic

Backbox 6 kernel 4.18.0-21-generic

Parrot OS 4.5.1 kernel 4.19.0-parrot1-13t-amd64

Kali kernel 4.19.0-kali5-amd64

Redcore 1806 (LXQT) kernel 4.16.16-redcore

MX 18.3 kernel 4.19.37-2~mx17+1

RHEL 8.0 kernel 4.18.0-80.el8.x86_64

Debian 9.4.0 kernel 4.9.0-6-amd64

Debian 10.0.0 kernel 4.19.0-5-amd64

Devuan 2.0.0 kernel 4.9.0-6-amd64

SparkyLinux 5.8 kernel 4.19.0-5-amd64

Fedora Workstation 30 kernel 5.0.9-301.fc30.x86_64

Manjaro 18.0.3 kernel 4.19.23-1-MANJARO

Mageia 6 kernel 4.9.35-desktop-1.mga6

Antergos 18.7 kernel 4.17.6-1-ARCH

首先添加一个用户

useradd guest;echo‘guest:123456‘|chpasswd

然后通过gcc进行编译 /tmp 目录下面才有权限-o 输出poc文件

gcc-s poc.c -o poc

当前用户再/home/目录下必须有文件夹

成功

参考文献

https://github.com/bcoles/kernel-exploits/blob/master/CVE-2019-13272/poc.c

https://zhuanlan.zhihu.com/p/76231535

再webshell下实现

python -c‘import pty;pty.spawn("/bin/sh")‘

然后再执行

参考文献

https://www.cnblogs.com/xdjun/p/7620531.html

https://www.cnblogs.com/Rightsec/p/10370132.html

CVE-2018-18955

参考文献

https://github.com/bcoles/kernel-exploits/blob/master/CVE-2018-18955/subuid_shell.c

https://www.freebuf.com/vuls/197122.html