RE: [Bulk] Re: Linux X86 fileutils-4x local root exploit

> On Tue, 2006-07-04 at 14:23 +0100, Sharpe, Sam J wrote:
> > I wouldn't run it if I were you.
> > 
> > I'm not an exploit guru, but I just ran it as me on a play server
> > (RHEL3) and ended up with a root shell prompt. 
> 
> it's not an actual root shell, it's a shell who's getuid() 
> function call is overloaded to return 0 always, so that the 
> /bin/sh process thinks it's called as root. That's not the 
> same as BEING root.
> 
> > Then the system hung...
> 
> yeah because the program has a forkbomb in it to prevent you 
> from doing much so that you on first face value can't find 
> out that the "root"
> shell isn't actually running with root privileges.
> 
> It's a nice haux, I'll give the author that ;-)

Nice. If you remove the forking (which I guess is why I have a play
server ;o) you can see:

sh-3.00# id
uid=0(root) gid=0(root) groups=10(wheel),100(users)
sh-3.00# cat /etc/shadow
cat: /etc/shadow: Permission denied

When I actually had a look at the "shellcode", all it does is write some
C to compile... Which when you read it makes it all pretty obvious.

sh-3.00# cat /tmp/own.c
int getuid() { return 0; }
int geteuid() { return 0; }
int getgid() { return 0; }
int getegid() { return 0; }

Some day, I'll actually read the code first rather than running it
against the play machine - ah the joys of being an impulsive youth!

--
Sam

--
Taroon-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/taroon-list