I've been trying to do some buffer overflow attack, and I thought I could use
system("/bin/bash") in order to obtain a root shell.
Then I read the documentation for
system()will not, in fact, work properly from programs with set-user-ID or set-group-ID privileges on systems on which
/bin/shis bash version 2, since bash 2 drops privileges on startup.
The system I am attacking has a bash version 4.3, and when I use a
system("/bin/bash"), I don't get root privileges (of course the initial program I am attacking starts with root privileges). My question is: will system drop privileges only on bash version 2, or will it drop them for any bash that has a version > 2?
/bin/bash just drops privileges, while
After reading comments from @StéphaneChazelas, EDIT2:
- check this link for more explanation and accuracy about bash dropping privileges.
-poption can be used to be sure to keep privileges when the bash spawns.