shell升级完整记录

[root@localhost bash-4.3.30]# cat Makefile |grep prefix

prefix = /usr/local

exec_prefix = ${prefix}

datarootdir = ${prefix}/share

bindir = ${exec_prefix}/bin

libdir = ${exec_prefix}/lib

includedir = ${prefix}/include

                prefix=${prefix} exec_prefix=${exec_prefix} \

 

[root@localhost bash-4.3.30]# whereis bash

bash: /usr/bin/bash /usr/local/bin/bash /usr/share/man/man1/bash.1.gz

[root@localhost bash-4.3.30]# /usr/bin/bas

base64      basename    bash        bashbug     bashbug-32 

[root@localhost bash-4.3.30]# /usr/bin/bash --version

GNU bash, version 4.2.45(1)-release (i686-redhat-linux-gnu)

Copyright (C) 2011 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

 

This is free software; you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.

[root@localhost bash-4.3.30]# /usr/local/bin/bash --version

GNU bash, version 4.3.30(1)-release (i686-pc-linux-gnu)

Copyright (C) 2013 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

 

This is free software; you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.

[root@localhost bash-4.3.30]#

 

库文件查询

[root@localhost bash-4.3.30]# ldd bash

        linux-gate.so.1 =>  (0xb779a000)

        libtinfo.so.5 => /lib/libtinfo.so.5 (0x4e41c000)

        libdl.so.2 => /lib/libdl.so.2 (0x4c65c000)

        libc.so.6 => /lib/libc.so.6 (0x4c49c000)

        /lib/ld-linux.so.2 (0x4c473000)

[root@localhost bash-4.3.30]#

 

 

[root@localhost shell_up_zhb]# chsh  -l

/bin/sh

/bin/bash

/sbin/nologin

/usr/bin/sh

/usr/bin/bash

/usr/sbin/nologin

[root@localhost shell_up_zhb]# lsof /bin/sh

COMMAND  PID USER  FD   TYPE DEVICE SIZE/OFF     NODE NAME

bash    8522 root txt    REG  253,1   917564 11014242 /usr/bin/bash

[root@localhost shell_up_zhb]# lsof /bin/bash

COMMAND  PID USER  FD   TYPE DEVICE SIZE/OFF     NODE NAME

bash    8522 root txt    REG  253,1   917564 11014242 /usr/bin/bash

sh      8914 root txt    REG  253,1   917564 11014242 /usr/bin/bash

[root@localhost shell_up_zhb]#

 

1以前的思路是拷贝升级后的可执行文件,库,配置文件(如果有),开始按此思路升级,失败,并且没法登陆。

2 后来发现chsh命令可以设置开机使用的sh,考虑升级登陆后的sh,开机使用另一个,升级成功后在,切换升级另一个。后来发现,系统实际上只用一个sh,次思路不对

3 bash升级只是为了修补心血漏洞,估计只需升级可执行文件即可。通过lsof发现,实际上使用的是/usr/bin/sh的shell,/bin/sh其实是连接,那就只拷贝/usr/bin/sh,/usr/bin/bash,拷贝时发现在使用,那就先复制在拷贝。

4 拷贝成功后,用测试例子试一下,发现可以

[NTP-Fedora20 shell_up_zhb]#env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

vulnerable

this is a test

[NTP-Fedora20 shell_up_zhb]#env x='() { :;}; echo vulnerable' ./bash -c "echo this is a test"

this is a test

5 reboot发现成功

 

posted @ 2016-02-14 17:01  周人假的  阅读(301)  评论(0编辑  收藏  举报