Wednesday, July 7, 2021

How To Run ANY COMMAND As The Owner Of The Script (setuid)

1. Save the below code as file a.c
    int main(int ac, char **av) {
        int uid;
        uid = geteuid();
        setreuid(uid, uid);

        char **arguments = av + 1;
        system(*arguments);

        return 0;
    }
2. As userA, compile it, ie
    gcc a.c -o aaa
3. As userA, set the sticky bit, ie
    chmod 4755 aaa
4. now you can run any command as UserA, like this:
    >aaa 'whoami'
    userA

    >aaa 'touch file1'
    >ls -al file1
    -rw-r----- 1 userA group

How To Bypass Kerberos(kinit) Authentication

Whenever you try to setuid and impersonate as someone else to run something, it is very likely that you will run into kerberos/kinit issues....