4 ms·
The SUID ones are for cases like "something you have exploited gives you the opportunity to execute one command as root; how can you leverage that for persisten
by caf 7y ago
The SUID ones are for cases like "something you have exploited gives you the opportunity to execute one command as root; how can you leverage that for persistent access?". So the idea is you make it SUID yourself, which gives you a partial way back in later.
- jcelerier 7y agobut if at some point you were root, you can most certainly install something in your victim's bootloader which is muuuch more effective
- caf 7y agoNot certainly - perhaps there's no device node available to you to open the device that contains the bootloader, and no mknod to create one?
- schoen 7y agoPerhaps then python -c 'import os; os.mknod("/tmp/yow", 0060000, 2048); os.chmod("/tmp/yow", 0777)' But clearly your point is right that a Unix environment could still prevent someone with root access from accessing the raw disk device, including at the kernel level.
- staticassertion 7y agoThat's not really something I expect from an attacker at all.