Re: [Bulk] Re: Linux X86 fileutils-4x local root exploit

Yes me too. I found it in a users /home . there goes my uptime !!!

-bob

----- Original Message ----- 
From: "Sharpe, Sam J" <sam.sharpe-AQ/[email protected]>
To: "Discussion of Red Hat Enterprise Linux 3 (Taroon)" 
<[email protected]>
Sent: Tuesday, July 04, 2006 6:36 AM
Subject: RE: [Bulk] Re: Linux X86 fileutils-4x local root exploit


>> On Tue, 2006-07-04 at 14:23 +0100, Sharpe, Sam J wrote:
>> > I wouldn't run it if I were you.
>> >
>> > I'm not an exploit guru, but I just ran it as me on a play server
>> > (RHEL3) and ended up with a root shell prompt.
>>
>> it's not an actual root shell, it's a shell who's getuid()
>> function call is overloaded to return 0 always, so that the
>> /bin/sh process thinks it's called as root. That's not the
>> same as BEING root.
>>
>> > Then the system hung...
>>
>> yeah because the program has a forkbomb in it to prevent you
>> from doing much so that you on first face value can't find
>> out that the "root"
>> shell isn't actually running with root privileges.
>>
>> It's a nice haux, I'll give the author that ;-)
>
> Nice. If you remove the forking (which I guess is why I have a play
> server ;o) you can see:
>
> sh-3.00# id
> uid=0(root) gid=0(root) groups=10(wheel),100(users)
> sh-3.00# cat /etc/shadow
> cat: /etc/shadow: Permission denied
>
> When I actually had a look at the "shellcode", all it does is write some
> C to compile... Which when you read it makes it all pretty obvious.
>
> sh-3.00# cat /tmp/own.c
> int getuid() { return 0; }
> int geteuid() { return 0; }
> int getgid() { return 0; }
> int getegid() { return 0; }
>
> Some day, I'll actually read the code first rather than running it
> against the play machine - ah the joys of being an impulsive youth!
>
> --
> Sam
>
> --
> Taroon-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/taroon-list 

--
Taroon-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/taroon-list