aix捉虫记之__invscoutd（aix捉虫记之 _ _ invscoutd）.docVIP

aix捉虫记之__invscoutd（aix捉虫记之 _ _ invscoutd） The __invscoutd AIX bug Creation time: 2004-06-04 update time: 2004-06-04 Article properties: Original Article submission: watercloud (watercloud_at_) AIX can catch insects Invscoutd This article is a short note of AIX security (in fact, screen copy), Tidy up, add some notes, share with interested friends:) [the article relates to a loophole I found on AIX4.x 5L, which allows ordinary users to get root privileges, and now IBM seems to have no patch, so I hope youll make good use of it.] Time: 2003-5-3 days The weather is sunny, cloudless sky with little white clouds Today, in a good mood, the first two days to catch AIXs security BUG, very fruitful, stack overflow, heap overflow, format string, PATH cheat, execute the command Ill continue today...... Platform information: -bash-2.05b$oslevel -bash-2.05b$oslevel -r 5100-01 Check the invscoutd command by typing -bash-2.05b$LS -l /usr/sbin/invscoutd -r-sr-xr-x 1, root, system, 217868, Aug, 032001, /usr/sbin/invscoutd | Were examining the reason? Need? Who told him to take this s?! First, lets know which way the command is mixed up -bash-2.05b$man invscoutd ............ The, invscoutd, command, implements, a, permanent, Inventory, Scout,, server, daemon, on One, machine, in, a, users, network., The, local, usual, client, is,, a, Java, applet, running In, the, users, Web, browser, which, was, downloaded, from, a,, central, Inventory, Scout CGI application. ............ After watching the nap, ing... Look at the look of this command: -bash-2.05b$invscoutd Invscoutd:, Missing, log, file, name. Inventory Scout Daemon 2.0.2. CAT VERSION @ @ @ @ @ @ USAGE: invscoutd [options] logfile also said to write the log file. Logfile Append status and err msgs. write to stderr. - means -o Overwrite preexisting log file instead of append. to overwrite the existing file can also be said to -pN Change port number to N from default 808. to the default listener on port 808 -bN, Change, read, buffer