why i can get root after running system(“/bin/shâ€) in c file?
Clash Royale CLAN TAG#URR8PPP
up vote
2
down vote
favorite
I am new to Linux and have a question here about root permission. I am currently logged in as seed and after running test.c, on my Ubuntu system, I get root permission. I am just wondering why system("/bin/sh") can make a such change?
Firstly, I su root and compile test.c in #, and also chmod 4755 test. When I exit #, run file and get root
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ id
uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(s
ambashare),130(wireshark),1001(vboxsf)
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ cat test.c
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
int main()
system("/bin/sh");
printf("successful!");
return 0;
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ ./test
# whoami
root
# id
uid=1000(seed) gid=1000(seed) euid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark),1000(seed),1001(vboxsf)
----update-----
[04/03/2018 06:03] seed@ubuntu:~/Desktop/assignment$ ls -l /bin/sh
lrwxrwxrwx 1 root root 4 Aug 13 2013 /bin/sh -> dash
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ uname -a
Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC
2013 i686 i686 i386 GNU/Linux
[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ ./test
# uname -a
Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 2013 i686 i686 i386 GNU/Linux
shell permissions root c
asked Apr 3 at 12:37
hei
142
add a comment |Â
up vote
2
down vote
favorite
I am new to Linux and have a question here about root permission. I am currently logged in as seed and after running test.c, on my Ubuntu system, I get root permission. I am just wondering why system("/bin/sh") can make a such change?
Firstly, I su root and compile test.c in #, and also chmod 4755 test. When I exit #, run file and get root
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ id
uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(s
ambashare),130(wireshark),1001(vboxsf)
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ cat test.c
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
int main()
system("/bin/sh");
printf("successful!");
return 0;
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ ./test
# whoami
root
# id
uid=1000(seed) gid=1000(seed) euid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark),1000(seed),1001(vboxsf)
----update-----
[04/03/2018 06:03] seed@ubuntu:~/Desktop/assignment$ ls -l /bin/sh
lrwxrwxrwx 1 root root 4 Aug 13 2013 /bin/sh -> dash
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ uname -a
Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC
2013 i686 i686 i386 GNU/Linux
[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ ./test
# uname -a
Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 2013 i686 i686 i386 GNU/Linux
shell permissions root c
asked Apr 3 at 12:37
hei
142
2
Maybe you have set SUID bit on/bin/sh. Please showls -l /bin/sh.
– Yurij Goncharuk
Apr 3 at 13:00
3
Or maybe you just have SUID on./test, you should also show us whatls -l testsays.
– Henrik
Apr 3 at 13:04
3
This may be because you compiled asrootandchmod 4755, so the SUID is set to the owner of the file, in this case is root
– tachomi
Apr 3 at 13:07
add a comment |Â
up vote
2
down vote
favorite
up vote
2
down vote
favorite
I am new to Linux and have a question here about root permission. I am currently logged in as seed and after running test.c, on my Ubuntu system, I get root permission. I am just wondering why system("/bin/sh") can make a such change?
Firstly, I su root and compile test.c in #, and also chmod 4755 test. When I exit #, run file and get root
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ id
uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(s
ambashare),130(wireshark),1001(vboxsf)
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ cat test.c
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
int main()
system("/bin/sh");
printf("successful!");
return 0;
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ ./test
# whoami
root
# id
uid=1000(seed) gid=1000(seed) euid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark),1000(seed),1001(vboxsf)
----update-----
[04/03/2018 06:03] seed@ubuntu:~/Desktop/assignment$ ls -l /bin/sh
lrwxrwxrwx 1 root root 4 Aug 13 2013 /bin/sh -> dash
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ uname -a
Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC
2013 i686 i686 i386 GNU/Linux
[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ ./test
# uname -a
Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 2013 i686 i686 i386 GNU/Linux
shell permissions root c
asked Apr 3 at 12:37
hei
142
I am new to Linux and have a question here about root permission. I am currently logged in as seed and after running test.c, on my Ubuntu system, I get root permission. I am just wondering why system("/bin/sh") can make a such change?
Firstly, I su root and compile test.c in #, and also chmod 4755 test. When I exit #, run file and get root
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ id
uid=1000(seed) gid=1000(seed) groups=1000(seed),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(s
ambashare),130(wireshark),1001(vboxsf)
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ cat test.c
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
int main()
system("/bin/sh");
printf("successful!");
return 0;
[04/03/2018 05:27] seed@ubuntu:~/Desktop/assignment$ ./test
# whoami
root
# id
uid=1000(seed) gid=1000(seed) euid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),124(sambashare),130(wireshark),1000(seed),1001(vboxsf)
----update-----
[04/03/2018 06:03] seed@ubuntu:~/Desktop/assignment$ ls -l /bin/sh
lrwxrwxrwx 1 root root 4 Aug 13 2013 /bin/sh -> dash
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ uname -a
Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC
2013 i686 i686 i386 GNU/Linux
[04/03/2018 06:14] seed@ubuntu:~/Desktop/assignment$ ./test
# uname -a
Linux ubuntu 3.5.0-37-generic #58~precise1-Ubuntu SMP Wed Jul 10 17:51:56 UTC 2013 i686 i686 i386 GNU/Linux
shell permissions root c
asked Apr 3 at 12:37
hei
142
edited Apr 3 at 13:17
asked Apr 3 at 12:37
hei
142
asked Apr 3 at 12:37
hei
142
asked Apr 3 at 12:37
hei
142
142
2
Maybe you have set SUID bit on/bin/sh. Please showls -l /bin/sh.
– Yurij Goncharuk
Apr 3 at 13:00
3
Or maybe you just have SUID on./test, you should also show us whatls -l testsays.
– Henrik
Apr 3 at 13:04
3
This may be because you compiled asrootandchmod 4755, so the SUID is set to the owner of the file, in this case is root
– tachomi
Apr 3 at 13:07
add a comment |Â
2
Maybe you have set SUID bit on/bin/sh. Please showls -l /bin/sh.
– Yurij Goncharuk
Apr 3 at 13:00
3
Or maybe you just have SUID on./test, you should also show us whatls -l testsays.
– Henrik
Apr 3 at 13:04
3
This may be because you compiled asrootandchmod 4755, so the SUID is set to the owner of the file, in this case is root
– tachomi
Apr 3 at 13:07
2
2
Maybe you have set SUID bit on
/bin/sh. Please show ls -l /bin/sh.– Yurij Goncharuk
Apr 3 at 13:00
Maybe you have set SUID bit on
/bin/sh. Please show ls -l /bin/sh.– Yurij Goncharuk
Apr 3 at 13:00
3
3
Or maybe you just have SUID on
./test, you should also show us what ls -l test says.– Henrik
Apr 3 at 13:04
Or maybe you just have SUID on
./test, you should also show us what ls -l test says.– Henrik
Apr 3 at 13:04
3
3
This may be because you compiled as
root and chmod 4755, so the SUID is set to the owner of the file, in this case is root– tachomi
Apr 3 at 13:07
This may be because you compiled as
root and chmod 4755, so the SUID is set to the owner of the file, in this case is root– tachomi
Apr 3 at 13:07
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
3
down vote
First, you compile your program as root, so resulting binary is owned by root:
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
# ^^^^
Second, by running chmod 4755 test you set setuid bit on ./test:
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
# ^
That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.
answered Apr 3 at 13:49
el.pescado
7310
That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52
@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
3
down vote
First, you compile your program as root, so resulting binary is owned by root:
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
# ^^^^
Second, by running chmod 4755 test you set setuid bit on ./test:
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
# ^
That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.
answered Apr 3 at 13:49
el.pescado
7310
That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52
@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31
add a comment |Â
up vote
3
down vote
First, you compile your program as root, so resulting binary is owned by root:
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
# ^^^^
Second, by running chmod 4755 test you set setuid bit on ./test:
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
# ^
That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.
answered Apr 3 at 13:49
el.pescado
7310
That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52
@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31
add a comment |Â
up vote
3
down vote
up vote
3
down vote
First, you compile your program as root, so resulting binary is owned by root:
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
# ^^^^
Second, by running chmod 4755 test you set setuid bit on ./test:
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
# ^
That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.
answered Apr 3 at 13:49
el.pescado
7310
First, you compile your program as root, so resulting binary is owned by root:
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
# ^^^^
Second, by running chmod 4755 test you set setuid bit on ./test:
[04/03/2018 06:04] seed@ubuntu:~/Desktop/assignment$ ls -l test
-rwsr-xr-x 1 root root 7198 Apr 3 05:56 test
# ^
That means, your binary is run as its file owner (=root), not as user that started it. That's why /bin/sh spawned by it is also run by root.
answered Apr 3 at 13:49
el.pescado
7310
answered Apr 3 at 13:49
el.pescado
7310
answered Apr 3 at 13:49
el.pescado
7310
answered Apr 3 at 13:49
el.pescado
7310
7310
That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52
@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31
add a comment |Â
That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52
@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31
That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52
That's correct. The inquiry in here is why ending the program, the effective user stays as root?
– tachomi
Apr 3 at 13:52
@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31
@tachomi the program hasn't yet ended; it's still running the subshell.
– roaima
Apr 3 at 14:31
add a comment |Â
Â
draft saved
draft discarded
Â
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f435264%2fwhy-i-can-get-root-after-running-system-bin-sh-in-c-file%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
2
Maybe you have set SUID bit on
/bin/sh. Please showls -l /bin/sh.– Yurij Goncharuk
Apr 3 at 13:00
3
Or maybe you just have SUID on
./test, you should also show us whatls -l testsays.– Henrik
Apr 3 at 13:04
3
This may be because you compiled as
rootandchmod 4755, so the SUID is set to the owner of the file, in this case is root– tachomi
Apr 3 at 13:07