3 ms·
One way I got root recently, aside from pivoting on a setuid 0 binary, was calling seteuid(0). The vendor's program manager on the device forgot to setuid(user_
by megous 8y ago
One way I got root recently, aside from pivoting on a setuid 0 binary, was calling seteuid(0). The vendor's program manager on the device forgot to setuid(user_id), it only seteuid(user_id). So going back to root was as easy as seteuid(0). The joy of real and effective process user. :)
Other easy way, if you have a way to provide your own filesystem to the device (via SD card for example), is to just put an Ext filesystem on it, and add your own setuid 0 binary there. Device makers sometimes don't know what they're doing, so they don't mount untrusted removable devices with -o nosuid,noexec,nodev ...
That works even if there's no usable setuid 0 binary on the rootfs.
- megous 8y agoIt doesn't help my confidence in the world, that this was a PoS terminal device from a self described "Leader in Payment Terminals". But hey, they even read random files on the filesystem from a kernel USB device driver, and they probably got to the market first, so that's what matters. Thankfully, AFAIK, this particular device is not sold anymore.
- microcolonel 8y ago> a self described "Leader in Payment Terminals" In a marathon, the leader is not so much the healthiest of the bunch. Also, this is a PoS terminal, if there's any wonder left in you for how they could mess this up so bad, I'm guessing this is the first one you've seen. ;- )
- megous 8y agoYes, the first one. One thing I liked about it though is that the vendor uses uniform ioctl calling convention for pretty much everything they implement in the kernel, so I have modified strace to decode their ioctl payload, and I was able to rewrite most of their library code with my implementation, with the help of traces of their demo app. Now I can drop their complicated and buggy userspace code completely and use my own rootfs. The kernel is harder, since they also violate GPL and don't provide kernel source code along with their terminal, and neither does their SoC vendor.
- amelius 8y agoYes, on Unix, cross-filesystem access control is traditionally illdefined, and I'm not surprised this is used to gain unauthorized access.