full-disclosure - Local suid files and buffer overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon Oct 10 07:25:21 2005
From: propolice at gmail.com (Eduardo Tongson)
Subject: Local suid files and buffer overflows

> Hi,
>
> first of all apologies for asking such a newbie question but I am trying
> to learn how to exploit buffer overflows and therefore wrote a little
> program to exploit. This little program has the following permissions:
>
> $ ls -la test1
> -rwsr-sr-x  1 root root 17164 Oct  8 01:25 test1
>
> Now I exploited it using Aleph One's shellcode (see
> http://shellcode.org/shellcode/linux/null-free/) but I won't get a SUID
> shell afterwards (I know the exploit did work but I still have my normal
> user privleges). Why? I have tried a different shellcode to write a file
> and this file was root:root. Any ideas, hints, rtfm?
>
> Thank you.
>

Use a setreuid/setuid shellcode <http://shellcode.org/shellcode/linux/setuid/>

-ed