5 ms·

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off): alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo' I don't think it matters that he used his root account. Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476 https://askubuntu.com/a/318476 Edit: Last exploit for Linux remote exploitation with Flash is from 2015 https://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_hacking_team_uaf https://www.rapid7.com/db/modules/exploit/multi/browser/adob... or did I miss something here?

wrycoder 9y ago
I use /usr/bin/sudo <>
- chrisfosterelli 9y ago
  So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.
  - wrycoder 9y ago
    Hm. How about ‘sudo’ <> ? i.e. quote the command?
    - chrisfosterelli 9y ago
      Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.
      - wrycoder 9y ago
        At least in bash, quoting the command disables any alias. Maybe also in zsh?
        chrisfosterelli 9y ago
        zsh seems to have much more flexible alias rules than bash: > alias \'sudo\'='ls -a' > 'sudo' . ..
    - wallacoloo 9y ago
      If they have access to your .bashrc they can also alter your PATH and create a script named sudo somewhere they have write access to that carries the malicious payload. So you're not gaining much by adding the quotes.
  - kbp 9y ago
    > So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`. $ alias /usr/bin/sudo=whatever bash: alias: `/usr/bin/sudo': invalid alias name
    - chrisfosterelli 9y ago
      Oh, fair point. Not all shells support this apparently. zsh does: -> alias /usr/bin/sudo='ls -a' -> /usr/bin/sudo . ..
JTechno 9y ago
I'm going to make a separate account just to run the web browser, xhost +localhost && su -c web-browser unprivileged-user
- freeloop3 9y ago
  If you're using xwindows they can just install a keylogger
LinuxBender 9y ago
As an attacker, I test for sudo -n. If it succeeds, I have root. In most cases I do not need it however. SSH key trusts, SSH multiplexing and bad posix permissions are more than enough to get me anywhere and grab anything.
jlgaddis 9y ago
There was a zero-day for Flash being exploited ITW just a few days ago.
- incompatible 9y ago
  I didn't think any browser on Linux still supported Flash.

wrycoder 9y ago

I use /usr/bin/sudo <>

chrisfosterelli 9y ago
So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.
- wrycoder 9y ago
  Hm. How about ‘sudo’ <> ? i.e. quote the command?
  - chrisfosterelli 9y ago
    Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.
    - wrycoder 9y ago
      At least in bash, quoting the command disables any alias. Maybe also in zsh?
      - chrisfosterelli 9y ago
        zsh seems to have much more flexible alias rules than bash: > alias \'sudo\'='ls -a' > 'sudo' . ..
  - wallacoloo 9y ago
    If they have access to your .bashrc they can also alter your PATH and create a script named sudo somewhere they have write access to that carries the malicious payload. So you're not gaining much by adding the quotes.
- kbp 9y ago
  > So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`. $ alias /usr/bin/sudo=whatever bash: alias: `/usr/bin/sudo': invalid alias name
  - chrisfosterelli 9y ago
    Oh, fair point. Not all shells support this apparently. zsh does: -> alias /usr/bin/sudo='ls -a' -> /usr/bin/sudo . ..

JTechno 9y ago

I'm going to make a separate account just to run the web browser, xhost +localhost && su -c web-browser unprivileged-user

freeloop3 9y ago
If you're using xwindows they can just install a keylogger

LinuxBender 9y ago

As an attacker, I test for sudo -n. If it succeeds, I have root. In most cases I do not need it however. SSH key trusts, SSH multiplexing and bad posix permissions are more than enough to get me anywhere and grab anything.

jlgaddis 9y ago

There was a zero-day for Flash being exploited ITW just a few days ago.

incompatible 9y ago
I didn't think any browser on Linux still supported Flash.