hi, i'm currently reading 'Hacking, the art of exploitation' and try to reproduce some of the examples there. One example would be to change the file permissions seeting the s flag on file, so it can be executed by any user as if it would be the file owner. what i'm doing is the following...
[kbear@HECHTNY]:~/Dev\> ls -la uidcheck
-rwxr-xr-x 1 kbear kbear 8621 Feb 6 15:42 uidcheck
[kbear@HECHTNY]:~/Dev\> ./uidcheck
real uid: 1000
effective uid: 1000
[kbear@HECHTNY]:~/Dev\> sudo chown root:root uidcheck
[kbear@HECHTNY]:~/Dev\> ls -la uidcheck
-rwxr-xr-x 1 root root 8621 Feb 6 15:42 uidcheck
[kbear@HECHTNY]:~/Dev\> sudo chmod u+s uidcheck
[kbear@HECHTNY]:~/Dev\> ls -la uidcheck
-rwsr-xr-x 1 root root 8621 Feb 6 15:42 uidcheck
[kbear@HECHTNY]:~/Dev\> ./uidcheck
real uid: 1000
effective uid: 1000
[kbear@HECHTNY]:~/Dev\>
the uidcheck file is a simple program that prints the userid as well as the effective userid (using getuid(), geteuid() respectively, see code below). after changing the owner to root and changing the file permission w/ the s flag i would expect the ids to be different and not the same. i did the same thing on the live-cd provided w/ the book and there it seems to work all fine.
Am i missing something or is this a security feature preventing this kind of change of file permissions.
thanks for the help
regards
Quote:
[kbear@HECHTNY]:~/Dev\> ls -la uidcheck
-rwxr-xr-x 1 kbear kbear 8621 Feb 6 15:42 uidcheck
[kbear@HECHTNY]:~/Dev\> ./uidcheck
real uid: 1000
effective uid: 1000
[kbear@HECHTNY]:~/Dev\> sudo chown root:root uidcheck
[kbear@HECHTNY]:~/Dev\> ls -la uidcheck
-rwxr-xr-x 1 root root 8621 Feb 6 15:42 uidcheck
[kbear@HECHTNY]:~/Dev\> sudo chmod u+s uidcheck
[kbear@HECHTNY]:~/Dev\> ls -la uidcheck
-rwsr-xr-x 1 root root 8621 Feb 6 15:42 uidcheck
[kbear@HECHTNY]:~/Dev\> ./uidcheck
real uid: 1000
effective uid: 1000
[kbear@HECHTNY]:~/Dev\>
Am i missing something or is this a security feature preventing this kind of change of file permissions.
thanks for the help
regards
Code:
#include <stdio.h>
int main(){
printf("real uid: %d\n",getuid());
printf("effective uid: %d\n",geteuid());
}
No comments:
Post a Comment