利用C-Linux setuid和系统命令

Question

I have the following code as an executable that I want to exploit for a course in order to spawn a shell with elevated privileges. I am a user of levelX and the executable has setgid of levelX+1. I am not allowed to alter any of the code. As I do not have root privileges, setguid(0) fails. I was not able to change the return address of the function or main function. Could anyone point to the right direction?

int main (int argc, char** argv)
{
  if (exec(argv[1]) != 0)
    {
      fprintf(stderr, "Cannot execute your command\n");
      return -1;
    }
  return 0;
}

int exec(char *command)
{
  FILE *f = NULL;
  char entry[64];
  char line[256];

  f = fopen("log", "a");
  if (f == NULL)
    {
      fprintf(stderr, "Can't open file\n");
      return -1;
    }
  snprintf(entry, 64, "%d: %s\n", getuid(), command);

  fprintf(f, entry, NULL);
  fclose(f);

  f = fopen("sudoers", "r");
  if (f == NULL)
    {
      fprintf(stderr, "Can't open\n");
      return -1;
    }

  while(fgets(line, 256, f) != NULL)
    {
      if (atoi(line) == getuid())
        {
          if (setuid(0) == 0) {
            system(command);
          } else {
            fprintf(stderr, "check permissions\n");
          }

          fclose(f);
          return 0;
        }
    }
  fprintf(stderr, "Error\n");
  fclose(f);
  return -1;
}

Answer 1

From the code you posted, it appears you are supposed to write your own sudoers file to any directory you have write access to, then run this program in that directory, so it reads your file.

So, simply write your own UID to this fake sudoers file, and then give a command parameter such as bash to get a shell. There's no need to do any buffer overflow exploitation.

Presumably the real exploitable program has suid bit set in the file permissions, so it can perform the setuid(0) call. I guess the purpose of the exercise is to demonstrate how all input needs to be sanitized when you are dealing with suid programs, including things like relative paths (which effectively take current working directory as input) like any user-supplied paths and other input.

---

But, since the program only has setgid bit (as said in comment), you need find something you do with just the group id. That something could be that log file write. You could create a symbolic link with file name log , pointing to whatever file you want to append to, which that group has write permissions for. Also, that file needs to have format such, that the log line format does not make the file corrupted. Remember, you can put newlines etc into command line arguments!

Answer 2

After all it was a format string exploit on fprintf(f, entry, NULL); inside int exec(char *command) where you overwrite the return address with %n format.