0

I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c):

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>

int main(int argc, char **argv)
{
  gid_t egid = getegid();
  setregid(egid, egid);

  system("cat /etc/passwd");
  return 0;
}

I need to call a program called "grade" with the group of the given program. I can't create new files. What can I do?

  • You can't create new files anywhere at all? Can you rename files? – domen Mar 29 at 16:28
  • No I can't. I have to use the privilege of stage to call grade and to change the directory to /home/stage3/ – Ervin Cosic Mar 29 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.