2 ms·
How did you verify that it was not in a VM? Did you achieve persistence? I think the article should have focused more on this as it's the most interesting and
by im3w1l 6y ago
How did you verify that it was not in a VM? Did you achieve persistence?
I think the article should have focused more on this as it's the most interesting and important part. execle and system are not really interesting, to paraphrase verroq: that just goes from arbitrary code execution to arbitrary code execution.
And disabling execle by recompiling library wont work, since you could still do a syscall "manually" with inline assembly.
- crecker 6y agoOnce I got into two compilers and achieved persistence (with a reverse shell), I stopped my investigation. I did not want to have any legal issues since I found some tokens that were used in production environment. I reported that to developers and they found that I could have access to sensible data. Thanks for the tips on the article!
- nikeee 6y agoIf you get the compiler errors, you can get an idea of the host system. For example, by testing these includes: #include </etc/hostname> #include </etc/hosts> #include </etc/passwd> If you get some info about the system/user the process is running as, you can even try something like #include </root/.ssh/id_rsa> #include </root/.bashrc> #include </root/.gitcredentials> etc
- crecker 6y agoAmazing! I never thought about this.