1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
|
/*
* build with: gcc -std=c99 -D_GNU_SOURCE=1 -Wall -O2 -ffunction-sections -fdata-sections -fomit-frame-pointer ./suidcmd.c -o ./suidcmd
* strip -s ./suidcmd
*/
#ifdef _HAVE_CONFIG
#include "config.h"
#endif
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/wait.h>
#ifndef CMD
#define CMD "/usr/sbin/ether-wake"
#endif
int safe_exec(const char* cmdWithArgs)
{
pid_t child;
if ( (child = fork()) == 0 ) {
size_t szCur = 0, szMax = 10;
char** args = calloc(szMax, sizeof(char**));
const char* cmd = NULL;
const char* prv = cmdWithArgs;
const char* cur = NULL;
while ( (cur = strchr(prv, ' ')) ) {
if (cmd == NULL)
cmd = strndup(prv, cur-prv);
args[szCur++] = strndup(prv, cur-prv);
if (szCur >= szMax) {
szMax *= 2;
args = realloc(args, sizeof(char**)*szMax);
}
cur++;
prv = cur;
}
if (cmd == NULL) {
cmd = cmdWithArgs;
} else {
args[szCur++] = strndup(prv, cur-prv);
}
args[szCur] = NULL;
execv(cmd, args);
} else {
int retval = 0;
waitpid(child, &retval, 0);
return retval;
}
return -1;
}
int main(int argc, char** argv)
{
uid_t ruid, euid, suid;
if (getresuid(&ruid, &euid, &suid) != 0) {
perror("getresuid()");
} else {
printf("%s: RUID:%u , EUID:%u , SUID:%u\n", argv[0], ruid, euid, suid);
}
if (setuid(0) != 0) {
perror("setuid(0)");
} else printf("%s: setuid(0)\n", argv[0]);
char* cmd = NULL;
if (asprintf(&cmd, "%s", CMD) <= 0) {
fprintf(stderr, "%s: asprintf(\"%s\") error\n", argv[0], CMD);
return 1;
}
char* prev_cmd = NULL;
for (int i = 1; i < argc; ++i) {
prev_cmd = cmd;
if (asprintf(&cmd, "%s %s", prev_cmd, argv[i]) < 0) {
fprintf(stderr, "%s: asprintf(\"%s\") error\n", argv[0], argv[i]);
return 1;
}
free(prev_cmd);
}
int retval = -1;
switch ( (retval = safe_exec(cmd)) ) {
case -1: fprintf(stderr, "%s: could not create child process..\n", argv[0]); return 1;
case 127: fprintf(stderr, "%s: could not execute shell (child process)..\n", argv[0]); return 1;
default:
printf("%s: child process returned with: %d\n", argv[0], retval);
}
free(cmd);
return 0;
}
|