LIDS all captures(14)

Add date: 09/17/2008 Publishing date: 09/17/2008 Hits: 3

Total 14 pages, Current page:14, Jump to page:

f = fopen (“/dev/tty”, “w+”);
if (! f)
return -1;

fprintf (f, “nE %x nI %x nP %x \ n”
“oE %x oI %x oP %x \ n \ n”,
new->effective, new->inheritable, new->permitted,
old->effective, old->inheritable, old->permitted);

/* Print New's advanced (effective) caps over old ones */
/* HACK! This is left here due to a private version of capcan */
for (i = 0; caps[i].value! = -1; ++i) {
if (capable (new->effective, caps[i].value) &&
! capable (old->effective, caps[i].value))
fprintf (f, “e %d %s \ n”, caps[i].value, caps[i].name);
}

printf (“\ n”);

/* Print New's advanced (inhertiable) caps over old ones */
for (i = 0; caps[i].value! = -1; ++i) {
if (capable (new->inheritable, caps[i].value) &&
! capable (old->inheritable, caps[i].value))
fprintf (f, “i %d %s \ n”, caps[i].value, caps[i].name);
}

/* No news */
if (new->effective == new->permitted)
return 0;

printf (“\ n”);

/* Print New's advanced permitted caps */
for (i = 0; caps[i].value! = -1; ++i) {
if (capable (new->permitted, caps[i].value) &&
! capable (old->permitted, caps[i].value))
fprintf (f, “p %d %s \ n”, caps[i].value, caps[i].name);
}

fclose(f);
return 0;
}

int brute_caps()
{
int i = 0;

for (; caps[i].value! = -1; ++i) {
if (caps[i] .try) {
if (caps[i] .try()) {
printf (“b %d %s \ n”, caps[i].value,
caps[i].name);
}
}
}
return 0;
}
---------------------------------------------------------------------------------
#capscan.c
---------------------------------------------------------------------------------
#include <stdio.h>
#include <errno.h>
#include <sys/types.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <dirent.h>
#include <fcntl.h>
#include “cap.h”

extern pid_t wait (int *);

void die (const char *s)
{
perror(s);
exit(errno);
}

int main (int argc, char ** argv)
{
cap_user_header h;
cap_user_data d, we;

h.version = _LINUX_CAPABILITY_VERSION;
h.pid = 0;

if (argc < 2) {
fprintf (stderr, “Usage: %s [- w] [- b] \ n”, *argv);
exit(1);
}

/* Just print the caps we have yet */
if (argv[1][1] == 'w') {
if (capget (&h, &we) < 0)
die (“capget”);

memset (&d, 0, sizeof(d));
print_cap (&we, &d);

} else if (argv[1][1] == 'b') {
brute_caps();
}
return 0;
}

Other pages: : <<Prev * 1 * 2 * 3 * 4 * 5 * 6 * 7 * 8 * 9 * 10 * 11 * 12 * 13 * 14

Prev:How to examine the VMware system

Next:IDS invasion examination (figure)

Comment:

Category: Home > invades the examination