简体   繁体   English

一个崩溃系统的C程序

[英]A C program to crash the system

A few days back I had an interview, and I was asked to write a program in C which crashes the system/which shuts down the system. 几天前我接受了一次采访,我被要求在C中编写一个程序,该程序崩溃系统/关闭系统。 Needless to say I felt pretty dumb having no clue on how to even approach :( 毋庸置疑,我觉得非常愚蠢,不知道如何接近:(

Still I gave it a try, writing programs which use a lot of memory. 我还是试了一下,编写了使用大量内存的程序。 But my interviewer was not satisfied with any of my techniques. 但我的采访者对我的任何技术都不满意。

It's easy to write a program that invokes undefined or implementation-defined behavior. 编写一个调用未定义或实现定义的行为的程序很容易。 Some of those programs could potentially crash the system. 其中一些程序可能会使系统崩溃。

But by definition, this is inconsistent. 但根据定义,这是不一致的。 And modern OSes take pains (though not 100% successfully) to prevent a rogue app from crashing the system. 现代操作系统很难(尽管不是100%成功)防止流氓应用程序崩溃系统。

There is no portable way to write a C program that crashes the system. 没有可移植的方法来编写崩溃系统的C程序。

A fork bomb might or might not bog down a system. 叉炸弹可能会或可能不会使系统陷入困境。 Of course fork is not portable -- and a system can defend itself against such attacks by limiting the number of processes a given account can create. 当然, fork不可移植 - 系统可以通过限制给定帐户可以创建的进程数来防御此类攻击。

Of course there's always this: 当然总有这个:

#include <stdio.h>
int main(void) {
    puts("HEY YOU, PULL THE PLUG!!");
    return 0;
}

Well, Have you tried following ? 好吧,你有没有尝试过?

void main(void) {
    system("shutdown -P 0");
}

To execute this program on Linux you must log in as root . 要在Linux上执行此程序,您必须以root身份登录。

I would try writing garbage to /dev/kmem . 我会尝试写垃圾到/dev/kmem There is a good chance that would cause an irrecoverable system crash. 很有可能导致无法恢复的系统崩溃。

One way to do that is by exploiting "Privilege Escalation" vulnerabilities of the current system. 一种方法是利用当前系统的“权限提升”漏洞。

Based on current configuration, you can search for vulnerabilities that impact the system. 根据当前配置,您可以搜索影响系统的漏洞。 Eg based on Kernel version. 例如基于内核版本。 And then escalate privileges to root. 然后将权限升级为root。

Once the process is "root", it can shutdown the system in various ways. 一旦进程为“root”,它就可以以各种方式关闭系统。 Sending SIGPWR to "init" process is one clean way of doing that. 将SIGPWR发送到“init”进程是一种干净的方法。

声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM