3 ms·
When you control environment variables, can't you also LDPRELOAD scary stuff?
by mkesper 6y ago
When you control environment variables, can't you also LDPRELOAD scary stuff?
- pentestercrab 6y agoThe second sentence of the blog post states: We were also unable to control the contents of a file on disk, and bruteforcing process identifiers (PIDs) and file descriptors found no interesting results, eliminating remote LD_PRELOAD exploitation.
- mkesper 6y agoOops, have overseen that one.
- rwmj 6y agoOr just set $PATH to a directory you control containing an "ls" binary. I don't understand what this post is on about at all - is it implying they've discovered a way to control environment variables of unrelated processes or users?
- 6AA4FD 6y ago> On a recent project we gained the ability to specify environment variables > We were also unable to control the contents of a file on disk From the first and second sentence.
- rwmj 6y agoThat's my point. What "recent project"? Is there a CVE?
- zxcmx 6y agoElttam are a security firm who offer (among other things) pentesting - so they would usually be working privately with, say, a client's website. One wouldn't usually file a CVE in these circumstances, if only the client is affected.