4 ms·
The exploit is overwriting /etc/shadow with the log of Xorg. If you pass the right string somehow you overwrite the root password. The trick is setting the font
by _nalply 8y ago
The exploit is overwriting /etc/shadow with the log of Xorg. If you pass the right string somehow you overwrite the root password. The trick is setting the font path and the font path appears in the log. Of course this fills /etc/shadow with a lot of bogus data, but one line in the log which describes the root password is enough. Xorg can overwrite /etc/shadow when it is setuid root.
Attention: don't attempt it on a system you need. The exploit is destroying all user's passwords. Or at least make a copy of /etc/shadow before trying.
- bruxis 8y agoAside form a manual backup, it appears that Xorg will create an `/etc/shadow.old` file (at least on the system I tested) that can be restored once root access is gained.
- smsm42 8y ago> The exploit is overwriting /etc/shadow with the log of Xorg. That took me couple of seconds to read and I got virtually the same information as the 11 minute video. I think there's no question about which way of doing things is more efficient.