Binary create a shell as another user-CodePudding

I have a specific question, I have a binary that launch a shell with execv but the shell change the user and with gdb i can't seem to find where the user change is happening.

level0@RainFall:~$ whoami
level0
level0@RainFall:~$ ls -la
-rwsr-x---  1 level1 users 747441 Mar  6  2016 level0
level0@RainFall:~$ gdb
(gdb) file level0
Reading symbols from /home/user/level0/level0...(no debugging symbols found)...done.
(gdb) run 423
Starting program: /home/user/level0/level0 423
process 3718 is executing new program: /bin/dash
$ whoami
level0

But when I don't use gdb:

level0@RainFall:~$ ./level0 423
$ whoami
level1
$

Here is the disas of main

   0x08048ec0 < 0>: push   ebp
   0x08048ec1 < 1>: mov    ebp,esp
   0x08048ec3 < 3>: and    esp,0xfffffff0
   0x08048ec6 < 6>: sub    esp,0x20
   0x08048ec9 < 9>: mov    eax,DWORD PTR [ebp 0xc]
   0x08048ecc < 12>:    add    eax,0x4
   0x08048ecf < 15>:    mov    eax,DWORD PTR [eax]
   0x08048ed1 < 17>:    mov    DWORD PTR [esp],eax
   0x08048ed4 < 20>:    call   0x8049710 <atoi>
   0x08048ed9 < 25>:    cmp    eax,0x1a7
   // it compare argv[1] with 423 if it is unequal it print No!
   0x08048ede < 30>:    jne    0x8048f58 <main 152>
   0x08048ee0 < 32>:    mov    DWORD PTR [esp],0x80c5348
   0x08048ee7 < 39>:    call   0x8050bf0 <strdup>
   0x08048eec < 44>:    mov    DWORD PTR [esp 0x10],eax
   0x08048ef0 < 48>:    mov    DWORD PTR [esp 0x14],0x0
   0x08048ef8 < 56>:    call   0x8054680 <getegid>
   0x08048efd < 61>:    mov    DWORD PTR [esp 0x1c],eax
   0x08048f01 < 65>:    call   0x8054670 <geteuid>
   0x08048f06 < 70>:    mov    DWORD PTR [esp 0x18],eax
   0x08048f0a < 74>:    mov    eax,DWORD PTR [esp 0x1c]
   0x08048f0e < 78>:    mov    DWORD PTR [esp 0x8],eax
   0x08048f12 < 82>:    mov    eax,DWORD PTR [esp 0x1c]
   0x08048f16 < 86>:    mov    DWORD PTR [esp 0x4],eax
   0x08048f1a < 90>:    mov    eax,DWORD PTR [esp 0x1c]
   0x08048f1e < 94>:    mov    DWORD PTR [esp],eax
   0x08048f21 < 97>:    call   0x8054700 <setresgid>
   0x08048f26 < 102>:   mov    eax,DWORD PTR [esp 0x18]
   0x08048f2a < 106>:   mov    DWORD PTR [esp 0x8],eax
   0x08048f2e < 110>:   mov    eax,DWORD PTR [esp 0x18]
   0x08048f32 < 114>:   mov    DWORD PTR [esp 0x4],eax
   0x08048f36 < 118>:   mov    eax,DWORD PTR [esp 0x18]
   0x08048f3a < 122>:   mov    DWORD PTR [esp],eax
   0x08048f3d < 125>:   call   0x8054690 <setresuid>
   0x08048f42 < 130>:   lea    eax,[esp 0x10]
   0x08048f46 < 134>:   mov    DWORD PTR [esp 0x4],eax
   0x08048f4a < 138>:   mov    DWORD PTR [esp],0x80c5348 
   //at this point euid and egid are the one of the user that launched gdb`
   0x08048f51 < 145>:   call   0x8054640 <execv>
   // we never go there since execv opens a shell
   0x08048f56 < 150>:   jmp    0x8048f80 <main 192>
   0x08048f58 < 152>:   mov    eax,ds:0x80ee170
   0x08048f5d < 157>:   mov    edx,eax
   0x08048f5f < 159>:   mov    eax,0x80c5350
   0x08048f64 < 164>:   mov    DWORD PTR [esp 0xc],edx
   0x08048f68 < 168>:   mov    DWORD PTR [esp 0x8],0x5
   0x08048f70 < 176>:   mov    DWORD PTR [esp 0x4],0x1
   0x08048f78 < 184>:   mov    DWORD PTR [esp],eax
   0x08048f7b < 187>:   call   0x804a230 <fwrite>
   0x08048f80 < 192>:   mov    eax,0x0
   0x08048f85 < 197>:   leave  
   0x08048f86 < 198>:   ret    
End of assembler dump.

I don't understand how the binary changes behaviour if I execute it by gdb or in the shell, maybe its because the binary's proprietary is level1?

If someone has the time to explain to me how it works I'll be really greatful

Thanks a lot

CodePudding user response：

I don't understand how the binary changes behaviour

The binary doesn't -- the kernel creates a new process with different UID when presented a set-uid binary (that's what s in -rwsr-x--- means).

For obvious security reasons the kernel doesn't do that when the binary is being debugged.