[HaBo]

#!/bin/bash
if [ "$1" = "on" ]; then
	echo "on"
	echo 1 > /sys/devices/platform/thinkpad_acpi/bluetooth_enable 
fi

if [ "$1" = "off" ]; then
	echo "off"
	echo 0 > /sys/devices/platform/thinkpad_acpi/bluetooth_enable 
fi

mathias@apprentice:~$ ls -l /usr/bin/bluetoothctl 
-rwsr-xr-x 1 root root 222 2009-04-11 11:00 /usr/bin/bluetoothctl
mathias@apprentice:~$

mathias@apprentice:~$ id
uid=1000(mathias) gid=1000(mathias) groups=20(dialout),24(cdrom),25(floppy),29(audio),44(video),46(plugdev),111(netdev),116(powerdev),1000(mathias)
mathias@apprentice:~$ bluetoothctl off
off
/usr/bin/bluetoothctl: line 10: /sys/devices/platform/thinkpad_acpi/bluetooth_enable: Permission denied
mathias@apprentice:~$

$ id
uid=1000 gid=1000
$ cat > id.sh <<EOF
#!/bin/bash -p
id
EOF
$ sudo chown root:root id.sh
$ sudo chmod 4755 id.sh
$ ./id.sh
uid=1000 gid=1000
// Aha, SUID bei dem sript bringt nichts.. (wussten wir schon, aber egal...)
// probieren wir was anderes:
$ sudo chmod 4755 /bin/bash
$ ./id.sh
uid=1000 gid=1000 euid=0 
// die effektive UID ist also 0, hmm, was könnten wir damit jetzt bloss alles machen..
// (dient nur zur Verdeutlichung , dass wir auch wirklich root-Privilegien haben)
$ /bin/bash -p -c 'tail -1 /etc/shadow' 
tcpdump:!:14330:0:99999:7:::
// wichtig! folgende zeile nicht vergessen...
$ sudo chmod 755 /bin/bash

# define B f[a]
char  f[2][26][82],i,j,a=0,c[]="_o",n;main(){B[3][3]=B[3][2]=B[3][1]=B[2][3]=B[1][2]=1;for
(;;){system("clear");for(i=1;i< 25;i++){for(j=1; j<81;j++){printf("%c",c[f[!a][i][j]]);n=B
[i-1][j-1]+B[i-1][j]+B[i-1][j+1]+B[i][j-1]+B[i][j+1]+B[i+1][j-1]+B[i+1][j]+B[i+1][j+1];f[!
a][i][j]=(!B[i][j]&&n==3) ||(B[i][j]&&n>1&&n<4);}puts("");}sleep(1);a=!a;}}

/* Is this shell running setuid? */
static int running_setuid;
...
  running_setuid = uidget ();
...
  if (running_setuid && privileged_mode == 0)
    disable_priv_mode ();
...
  setuid (current_user.uid);
  setgid (current_user.gid);
...

/usr/bin/bluetoothctl: line 10: /sys/devices/platform/thinkpad_acpi/bluetooth_enable: Permission denied

# define B f[a]
char  f[2][26][82],i,j,a=0,c[]="_o",n;main(){B[3][3]=B[3][2]=B[3][1]=B[2][3]=B[1][2]=1;for
(;;){system("clear");for(i=1;i< 25;i++){for(j=1; j<81;j++){printf("%c",c[f[!a][i][j]]);n=B
[i-1][j-1]+B[i-1][j]+B[i-1][j+1]+B[i][j-1]+B[i][j+1]+B[i+1][j-1]+B[i+1][j]+B[i+1][j+1];f[!
a][i][j]=(!B[i][j]&&n==3) ||(B[i][j]&&n>1&&n<4);}puts("");}sleep(1);a=!a;}}