[CentOS] 10-1. suidtest

# ls -l /etc/shadow

-r-------- 1 root root 2158 Jul 15 21:15 /etc/shadow

# ls -l /usr/bin/head 

-rwxr-xr-x 1 root root 29212 Mar 21  2012 /usr/bin/head

# useradd headuser

# su - headuser

$ head /etc/shadow

head: cannot open `/etc/shadow' for reading: Permission denied

$ exit

# chmod u+s /usr/bin/head 

# ls -l /usr/bin/head 

-rwsr-xr-x 1 root root 29212 Mar 21  2012 /usr/bin/head

# su - headuser

$ head /etc/shadow

root:$6$nmLBZVkD$pstH .../:16626:0:99999:7

  :

  :

$ exit

# echo 1234 | passwd --stdin headuser

# tail -1 /etc/shadow

headuser:$6$.xKuWGln$6U...:16631:0:99999:7:::

# su - headuser

$ passwd

Changing password for user headuser.

Changing password for headuser

(current) UNIX password: 

passwd: Authentication token manipulation error

$ !!

passwd

Changing password for user headuser.

Changing password for headuser

(current) UNIX password:   <-- 1234 입력

New UNIX password: 

Retype new UNIX password: 

passwd: all authentication tokens updated successfully.

$ exit

# tail -1 /etc/shadow

headuser:$6$CD2VyJWC$NbYm08fP...:16631:0:99999:7:::

# ls -l `which passwd`

-rwsr-xr-x 1 root root 23420 Aug 11  2010 /usr/bin/passwd