5 ms·
Maybe it can be used to write a "0" into a useful kernel structure such as a forked process' effective uid (thus escalating to uid0)
by 0x0 8y ago
Maybe it can be used to write a "0" into a useful kernel structure such as a forked process' effective uid (thus escalating to uid0)
- Sohcahtoa82 8y agoWouldn't that just be a privilege escalation though, not arbitrary code execution?
- 0x0 8y agoWell if you are root then you can usually load random kernel modules and in general do whatever you want on the system.
- prudhvis 8y agoDoes that mean then, that every privilege escalation be arbitrary code execution?
- darawk 8y agoI'd say so, yes, assuming that you can then execute arbitrary code with the elevated privileges.
- Sohcahtoa82 8y agoI'd say no, because to be able to make a privilege escalation attack useful, you'd have to already have arbitrary code execution.
- darawk 8y agoNot necessarily. You could, for instance, elevate the privileges of a process you can't completely control, which might allow you to read sensitive files or disrupt a system, but not perform arbitrary actions with those privileges.
- Sohcahtoa82 8y agoI concede that privesc without code execution can be useful, but my original claim that privesc is not necessarily code execution still stands.
- darawk 8y agoI think we agree then? I said "assuming you can execute arbitrary code with the elevated privileges".
- SahAssar 8y agoNo, in some cases code execution is not the goal at all. A privesc can mean admin access to a system you didn't previously have access to, it can mean access to logs or a direct tap into network data in some systems. You often don't need arbitrary code exec for that since its features built into the apps or the systems hosting them.
- SahAssar 8y agoNo, since privilege escalation can also mean that you are able to take specific actions that you wouldn't otherwise be able to take. It does not always mean code execution.
- Sohcahtoa82 8y agoRight...but that doesn't mean it's correct to refer to a privesc exploit as arbitrary code execution. For a privesc exploit to be valuable, you typically need to already have code execution. EDIT: I concede in another comment that privesc without code execution can still be useful, but my original claim that privesc does not imply arbitrary code execution still stands.
- 0x0 8y agoMaybe it's shorthand for "arbitrary code execution in the kernel mode context".
- SahAssar 8y agoThat is not true for all systems, a lot of attacks in most systems do not need code execution but do need privilege escalation. Getting privilege escalation by definition means that _you are allowed to do stuff you couldn't_ which in itself is an attack vector.
- zAy0LfpBZLC8mAC 8y agoBut privilege escalation does not imply "being root", it only means "ability to perform operation as root" (or whatever the role is can can be compromised). If your distribution accidentally packaged a suid root /bin/cat, that would allow a normal user to perform (read) operations on all files on the system, so it would be a privilege escalation, but it would not necessarily lead to arbitrary code execution as root (unless that allowed you to read a file with the root password, say).
- Sohcahtoa82 8y agoGoing off topic, but did you use a password generator to create your username or something? Or does it have a meaning?
- Y_Y 8y agoIt's the payload for a browser exploit
- muricula 8y agoOverwrite the return address or a function pointer instead. Then when the address/pointer is used you can execute whatever you want. Loop up Return Oriented Programming.