why i can get root after running system(“/bin/sh”) in c file?

up vote
2
down vote

favorite

I am currently logged in as seed and after running test.c, on my Ubuntu system, I get root permission. I am just wondering why system("/bin/sh") can make a such change?

Firstly, I su root and compile test.c in #, and also chmod 4755 test. When I exit #, run file and get root

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ id

uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(s 

ambashare),130(wireshark),1001(vboxsf)

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ cat test.c

#include <stdio.h>

#include <unistd.h>

#include <sys/types.h>



int main(){





system("/bin/sh");

printf("successful!");

return 0;





}

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ ./test

# whoami

root

# id 

uid=1000(seed) gid=1000(seed) euid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark),1000(seed),1001(vboxsf)

----update-----

[04/03/2018 06:03] seed@ubuntu:~/Desktop/assignment$ ls -l /bin/sh

lrwxrwxrwx 1 root root 4 Aug 13  2013 /bin/sh -> dash

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test





[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ uname -a

Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 

2013 i686 i686 i386 GNU/Linux

[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ ./test

# uname -a

Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 2013 i686 i686 i386 GNU/Linux

edited Nov 25 at 14:15

Rui F Ribeiro

38.3k1475126

asked Apr 3 at 12:37

hei

142

2

Maybe you have set SUID bit on /bin/sh. Please show ls -l /bin/sh.
– Yurij Goncharuk
Apr 3 at 13:00

3

Or maybe you just have SUID on ./test, you should also show us what ls -l test says.
– Henrik
Apr 3 at 13:04

3

This may be because you compiled as root and chmod 4755, so the SUID is set to the owner of the file, in this case is root
– tachomi
Apr 3 at 13:07

add a comment |

up vote
2
down vote

favorite

I am currently logged in as seed and after running test.c, on my Ubuntu system, I get root permission. I am just wondering why system("/bin/sh") can make a such change?

Firstly, I su root and compile test.c in #, and also chmod 4755 test. When I exit #, run file and get root

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ id

uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(s 

ambashare),130(wireshark),1001(vboxsf)

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ cat test.c

#include <stdio.h>

#include <unistd.h>

#include <sys/types.h>



int main(){





system("/bin/sh");

printf("successful!");

return 0;





}

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ ./test

# whoami

root

# id 

uid=1000(seed) gid=1000(seed) euid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark),1000(seed),1001(vboxsf)

----update-----

[04/03/2018 06:03] seed@ubuntu:~/Desktop/assignment$ ls -l /bin/sh

lrwxrwxrwx 1 root root 4 Aug 13  2013 /bin/sh -> dash

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test





[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ uname -a

Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 

2013 i686 i686 i386 GNU/Linux

[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ ./test

# uname -a

Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 2013 i686 i686 i386 GNU/Linux

edited Nov 25 at 14:15

Rui F Ribeiro

38.3k1475126

asked Apr 3 at 12:37

hei

142

2

Maybe you have set SUID bit on /bin/sh. Please show ls -l /bin/sh.
– Yurij Goncharuk
Apr 3 at 13:00

3

Or maybe you just have SUID on ./test, you should also show us what ls -l test says.
– Henrik
Apr 3 at 13:04

3

This may be because you compiled as root and chmod 4755, so the SUID is set to the owner of the file, in this case is root
– tachomi
Apr 3 at 13:07

add a comment |

up vote
2
down vote

favorite

I am currently logged in as seed and after running test.c, on my Ubuntu system, I get root permission. I am just wondering why system("/bin/sh") can make a such change?

Firstly, I su root and compile test.c in #, and also chmod 4755 test. When I exit #, run file and get root

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ id

uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(s 

ambashare),130(wireshark),1001(vboxsf)

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ cat test.c

#include <stdio.h>

#include <unistd.h>

#include <sys/types.h>



int main(){





system("/bin/sh");

printf("successful!");

return 0;





}

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ ./test

# whoami

root

# id 

uid=1000(seed) gid=1000(seed) euid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark),1000(seed),1001(vboxsf)

----update-----

[04/03/2018 06:03] seed@ubuntu:~/Desktop/assignment$ ls -l /bin/sh

lrwxrwxrwx 1 root root 4 Aug 13  2013 /bin/sh -> dash

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test





[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ uname -a

Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 

2013 i686 i686 i386 GNU/Linux

[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ ./test

# uname -a

Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 2013 i686 i686 i386 GNU/Linux

edited Nov 25 at 14:15

Rui F Ribeiro

38.3k1475126

asked Apr 3 at 12:37

hei

142

I am currently logged in as seed and after running test.c, on my Ubuntu system, I get root permission. I am just wondering why system("/bin/sh") can make a such change?

Firstly, I su root and compile test.c in #, and also chmod 4755 test. When I exit #, run file and get root

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ id

uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(s 

ambashare),130(wireshark),1001(vboxsf)

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ cat test.c

#include <stdio.h>

#include <unistd.h>

#include <sys/types.h>



int main(){





system("/bin/sh");

printf("successful!");

return 0;





}

[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ ./test

# whoami

root

# id 

uid=1000(seed) gid=1000(seed) euid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark),1000(seed),1001(vboxsf)

----update-----

[04/03/2018 06:03] seed@ubuntu:~/Desktop/assignment$ ls -l /bin/sh

lrwxrwxrwx 1 root root 4 Aug 13  2013 /bin/sh -> dash

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test





[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ uname -a

Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 

2013 i686 i686 i386 GNU/Linux

[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ ./test

# uname -a

Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 2013 i686 i686 i386 GNU/Linux

shell permissions root c

edited Nov 25 at 14:15

Rui F Ribeiro

38.3k1475126

asked Apr 3 at 12:37

hei

142

edited Nov 25 at 14:15

Rui F Ribeiro

38.3k1475126

asked Apr 3 at 12:37

hei

142

edited Nov 25 at 14:15

Rui F Ribeiro

38.3k1475126

edited Nov 25 at 14:15

Rui F Ribeiro

38.3k1475126

edited Nov 25 at 14:15

Rui F Ribeiro

38.3k1475126

asked Apr 3 at 12:37

hei

142

asked Apr 3 at 12:37

hei

142

asked Apr 3 at 12:37

hei

142

2

Maybe you have set SUID bit on /bin/sh. Please show ls -l /bin/sh.
– Yurij Goncharuk
Apr 3 at 13:00

3

Or maybe you just have SUID on ./test, you should also show us what ls -l test says.
– Henrik
Apr 3 at 13:04

3

This may be because you compiled as root and chmod 4755, so the SUID is set to the owner of the file, in this case is root
– tachomi
Apr 3 at 13:07

add a comment |

2

Maybe you have set SUID bit on /bin/sh. Please show ls -l /bin/sh.
– Yurij Goncharuk
Apr 3 at 13:00

3

Or maybe you just have SUID on ./test, you should also show us what ls -l test says.
– Henrik
Apr 3 at 13:04

3

This may be because you compiled as root and chmod 4755, so the SUID is set to the owner of the file, in this case is root
– tachomi
Apr 3 at 13:07

Maybe you have set SUID bit on /bin/sh. Please show ls -l /bin/sh.
– Yurij Goncharuk
Apr 3 at 13:00

Or maybe you just have SUID on ./test, you should also show us what ls -l test says.
– Henrik
Apr 3 at 13:04

This may be because you compiled as root and chmod 4755, so the SUID is set to the owner of the file, in this case is root
– tachomi
Apr 3 at 13:07

add a comment |

1 Answer
1

active

oldest

votes

up vote
3
down vote

First, you compile your program as root, so resulting binary is owned by root:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test

#            ^^^^

Second, by running chmod 4755 test you set setuid bit on ./test:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test

#  ^

That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.

answered Apr 3 at 13:49

el.pescado

7310

That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52

1

@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31

add a comment |

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f435264%2fwhy-i-can-get-root-after-running-system-bin-sh-in-c-file%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
3
down vote

First, you compile your program as root, so resulting binary is owned by root:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test

#            ^^^^

Second, by running chmod 4755 test you set setuid bit on ./test:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test

#  ^

That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.

answered Apr 3 at 13:49

el.pescado

7310

That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52

1

@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31

add a comment |

up vote
3
down vote

First, you compile your program as root, so resulting binary is owned by root:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test

#            ^^^^

Second, by running chmod 4755 test you set setuid bit on ./test:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test

#  ^

That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.

answered Apr 3 at 13:49

el.pescado

7310

That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52

1

@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31

add a comment |

up vote
3
down vote

First, you compile your program as root, so resulting binary is owned by root:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test

#            ^^^^

Second, by running chmod 4755 test you set setuid bit on ./test:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test

#  ^

That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.

answered Apr 3 at 13:49

el.pescado

7310

First, you compile your program as root, so resulting binary is owned by root:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test

#            ^^^^

Second, by running chmod 4755 test you set setuid bit on ./test:

[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test

-rwsr-xr-x 1 root root 7198 Apr  3 05:56 test

#  ^

That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.

answered Apr 3 at 13:49

el.pescado

7310

answered Apr 3 at 13:49

el.pescado

7310

answered Apr 3 at 13:49

el.pescado

7310

answered Apr 3 at 13:49

el.pescado

7310

That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52

1

@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31

add a comment |

That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52

1

@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31

That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52

@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31

add a comment |

draft saved

draft discarded

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Sstrhsrtj