3 ms·

Hi, author here! I wrote that post two years ago and at least in 2 environment, there was no sandbox or under Docker. I remember that I found an interesting en

Hi, author here! I wrote that post two years ago and at least in 2 environment, there was no sandbox or under Docker. I remember that I found an interesting environment that an interesting script. The script parsed the input file and then chose if it could be compiled or not. Well, it's really easy to circumvent that. In 2020, I would be impressed to see someone shipping such application without sandbox/VM.

aspyct 6y ago
I don't think docker would be an appropriate security measure here. To be fair, docker is great, but I remember a few warnings about how users could get root access to the "host" machine. It's containers, not VMs.
- MaxBarraclough 6y ago
  Right, docker is great for configuration and deployment, but it's not a strong sandbox for untrusted code. AWS doesn't offer to run your docker container on a Linux instance shared with other customers' containers. VMs are the correct abstraction for secure isolation, not docker.
im3w1l 6y ago
How did you verify that it was not in a VM? Did you achieve persistence? I think the article should have focused more on this as it's the most interesting and important part. execle and system are not really interesting, to paraphrase verroq: that just goes from arbitrary code execution to arbitrary code execution. And disabling execle by recompiling library wont work, since you could still do a syscall "manually" with inline assembly.
- crecker 6y ago
  Once I got into two compilers and achieved persistence (with a reverse shell), I stopped my investigation. I did not want to have any legal issues since I found some tokens that were used in production environment. I reported that to developers and they found that I could have access to sensible data. Thanks for the tips on the article!
- nikeee 6y ago
  If you get the compiler errors, you can get an idea of the host system. For example, by testing these includes: #include </etc/hostname> #include </etc/hosts> #include </etc/passwd> If you get some info about the system/user the process is running as, you can even try something like #include </root/.ssh/id_rsa> #include </root/.bashrc> #include </root/.gitcredentials> etc
  - crecker 6y ago
    Amazing! I never thought about this.

aspyct 6y ago

I don't think docker would be an appropriate security measure here. To be fair, docker is great, but I remember a few warnings about how users could get root access to the "host" machine. It's containers, not VMs.

MaxBarraclough 6y ago
Right, docker is great for configuration and deployment, but it's not a strong sandbox for untrusted code. AWS doesn't offer to run your docker container on a Linux instance shared with other customers' containers. VMs are the correct abstraction for secure isolation, not docker.

im3w1l 6y ago

How did you verify that it was not in a VM? Did you achieve persistence? I think the article should have focused more on this as it's the most interesting and important part. execle and system are not really interesting, to paraphrase verroq: that just goes from arbitrary code execution to arbitrary code execution. And disabling execle by recompiling library wont work, since you could still do a syscall "manually" with inline assembly.

crecker 6y ago
Once I got into two compilers and achieved persistence (with a reverse shell), I stopped my investigation. I did not want to have any legal issues since I found some tokens that were used in production environment. I reported that to developers and they found that I could have access to sensible data. Thanks for the tips on the article!
nikeee 6y ago
If you get the compiler errors, you can get an idea of the host system. For example, by testing these includes: #include </etc/hostname> #include </etc/hosts> #include </etc/passwd> If you get some info about the system/user the process is running as, you can even try something like #include </root/.ssh/id_rsa> #include </root/.bashrc> #include </root/.gitcredentials> etc
- crecker 6y ago
  Amazing! I never thought about this.