2

I am currently logged in as seed and after running test.c, on my Ubuntu system, I get root permission. I am just wondering why system("/bin/sh") can make a such change?

Firstly, I su root and compile test.c in #, and also chmod 4755 test. When I exit #, run file and get root

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ id
uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(s 
ambashare),130(wireshark),1001(vboxsf)
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ cat test.c
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

int main(){


system("/bin/sh");
printf("successful!");
return 0;


}
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ ./test
# whoami
root
# id 
uid=1000(seed) gid=1000(seed) euid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark),1000(seed),1001(vboxsf)

----update-----

[04/03/2018 06:03] seed@ubuntu:~/Desktop/assignment$ ls -l /bin/sh
lrwxrwxrwx 1 root root 4 Aug 13  2013 /bin/sh -> dash
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test


[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ uname -a
Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 
2013 i686 i686 i386 GNU/Linux
[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ ./test
# uname -a
Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 2013 i686 i686 i386 GNU/Linux
  • 2
    Maybe you have set SUID bit on /bin/sh. Please show ls -l /bin/sh. – Yurij Goncharuk Apr 3 '18 at 13:00
  • 3
    Or maybe you just have SUID on ./test, you should also show us what ls -l test says. – Henrik supports the community Apr 3 '18 at 13:04
  • 3
    This may be because you compiled as root and chmod 4755, so the SUID is set to the owner of the file, in this case is root – tachomi Apr 3 '18 at 13:07
3

First, you compile your program as root, so resulting binary is owned by root:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test
#            ^^^^

Second, by running chmod 4755 test you set setuid bit on ./test:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test
#  ^

That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.

  • That's correct. The inquiry in here is why ending the program, the effective user stays as root? – tachomi Apr 3 '18 at 13:52
  • 1
    @tachomi the program hasn't yet ended; it's still running the subshell. – roaima Apr 3 '18 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.