PROGRAMMING - Hacking: The Art of Exploitation - page 90

uid_demo.c
#include <stdio.h>
int main() {
printf("real uid: %d\n", getuid());
printf("effective uid: %d\n", geteuid());
}
The results of compiling and executing uid_demo.c are as follows.
reader@hacking:~/booksrc $ gcc -o uid_demo uid_demo.c
reader@hacking:~/booksrc $ ls -l uid_demo
-rwxr-xr-x 1 reader reader 6825 2007-09-07 05:32 uid_demo
reader@hacking:~/booksrc $ ./uid_demo
real uid: 999
effective uid: 999
reader@hacking:~/booksrc $ sudo chown root:root ./uid_demo
reader@hacking:~/booksrc $ ls -l uid_demo
-rwxr-xr-x 1 root root 6825 2007-09-07 05:32 uid_demo
reader@hacking:~/booksrc $ ./uid_demo
real uid: 999
effective uid: 999
reader@hacking:~/booksrc $
In the output for uid_demo.c, both user IDs are shown to be 999 when
uid_demo is executed, since 999 is the user ID for reader. Next, the sudo com-
mand is used with the chown command to change the owner and group of
uid_demo to root. The program can still be executed, since it has execute
permission for other, and it shows that both user IDs remain 999, since
that's still the ID of the user.
reader@hacking:~/booksrc $ chmod u+s ./uid_demo
chmod: changing permissions of `./uid_demo': Operation not permitted
reader@hacking:~/booksrc $ sudo chmod u+s ./uid_demo
reader@hacking:~/booksrc $ ls -l uid_demo
-rwsr-xr-x 1 root root 6825 2007-09-07 05:32 uid_demo
reader@hacking:~/booksrc $ ./uid_demo
real uid: 999
effective uid: 0
r eader@hacking:~/booksrc $
Since the program is owned by root now, sudo must be used to change
file permissions on it. The chmod u+s command turns on the setuid permis-
sion, which can be seen in the following ls -l output. Now when the user
reader executes uid_demo , the effective user ID is 0 for root, which means the
program can access files as root. This is how the chsh program is able to allow
any user to change his or her login shell stored in /etc/passwd.