shell升级完整记录

[root@localhost bash-4.3.30]# cat Makefile |grep prefix

prefix = /usr/local

exec_prefix = ${prefix}

datarootdir = ${prefix}/share

bindir = ${exec_prefix}/bin

libdir = ${exec_prefix}/lib

includedir = ${prefix}/include

prefix=${prefix} exec_prefix=${exec_prefix} \

[root@localhost bash-4.3.30]# whereis bash

bash: /usr/bin/bash /usr/local/bin/bash /usr/share/man/man1/bash.1.gz

[root@localhost bash-4.3.30]# /usr/bin/bas

base64      basename    bash        bashbug     bashbug-32

[root@localhost bash-4.3.30]# /usr/bin/bash --version

GNU bash, version 4.2.45(1)-release (i686-redhat-linux-gnu)

Copyright (C) 2011 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.

[root@localhost bash-4.3.30]# /usr/local/bin/bash --version

GNU bash, version 4.3.30(1)-release (i686-pc-linux-gnu)

Copyright (C) 2013 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.

[root@localhost bash-4.3.30]#

库文件查询

[root@localhost bash-4.3.30]# ldd bash

linux-gate.so.1 =>  (0xb779a000)

libtinfo.so.5 => /lib/libtinfo.so.5 (0x4e41c000)

libdl.so.2 => /lib/libdl.so.2 (0x4c65c000)

libc.so.6 => /lib/libc.so.6 (0x4c49c000)

/lib/ld-linux.so.2 (0x4c473000)

[root@localhost bash-4.3.30]#

[root@localhost shell_up_zhb]# chsh  -l

/bin/sh

/bin/bash

/sbin/nologin

/usr/bin/sh

/usr/bin/bash

/usr/sbin/nologin

[root@localhost shell_up_zhb]# lsof /bin/sh

COMMAND  PID USER  FD   TYPE DEVICE SIZE/OFF     NODE NAME

bash    8522 root txt    REG  253,1   917564 11014242 /usr/bin/bash

[root@localhost shell_up_zhb]# lsof /bin/bash

COMMAND  PID USER  FD   TYPE DEVICE SIZE/OFF     NODE NAME

bash    8522 root txt    REG  253,1   917564 11014242 /usr/bin/bash

sh      8914 root txt    REG  253,1   917564 11014242 /usr/bin/bash

[root@localhost shell_up_zhb]#

1以前的思路是拷贝升级后的可执行文件，库，配置文件（如果有），开始按此思路升级，失败，并且没法登陆。

2 后来发现chsh命令可以设置开机使用的sh，考虑升级登陆后的sh，开机使用另一个，升级成功后在，切换升级另一个。后来发现，系统实际上只用一个sh，次思路不对

3 bash升级只是为了修补心血漏洞，估计只需升级可执行文件即可。通过lsof发现，实际上使用的是/usr/bin/sh的shell，/bin/sh其实是连接，那就只拷贝/usr/bin/sh，/usr/bin/bash,拷贝时发现在使用，那就先复制在拷贝。

4 拷贝成功后，用测试例子试一下，发现可以

[NTP-Fedora20 shell_up_zhb]#env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

vulnerable

this is a test

[NTP-Fedora20 shell_up_zhb]#env x='() { :;}; echo vulnerable' ./bash -c "echo this is a test"

this is a test

5 reboot发现成功