7 ms·
I wrote one myself. Fun things: 'int getuid() { return 0; }' in the userland code was sufficient for authentication. And the mountd returned the root handle of
by apk17 11y ago
I wrote one myself. Fun things: 'int getuid() { return 0; }' in the userland code was sufficient for authentication. And the mountd returned the root handle of the file system. When you presented that handle to nfsd it would happily serve you even when you are no longer in the exports table.
- tptacek 11y agoNFS also hosted one of the first widely-exploited integer overflows (not for code exec, but for privilege escalation).