6 ms·

It's not referring to having sudo ALL permissions, but to users having sudo permissions for individual applications. So if you are trying to privilege escalate

It's not referring to having sudo ALL permissions, but to users having sudo permissions for individual applications. So if you are trying to privilege escalate a linux box and sudo -l returns: (root) /usr/sbin/tcpdump You check gtfobins for tcpdump and see that you can get a root shell with sudo access.

pjmlp 5y ago
If the server admin was dumb enough to allow executables on $HOME, or anywhere where the user has write access.
- NavinF 5y ago
  Why would the attacker need to set the execute bit on the file they want to execute? Can't they just run "tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z /lib64/ld-linux-x86-64.so.2" and then swap the tcpdump savefile with the file they want to execute? That will run "ld-linux-x86-64.so.2 ./savefile" after a few seconds which is the same thing as running "chmod +x savefile; ./savefile" https://unix.stackexchange.com/questions/400621/what-is-lib64-ld-linux-x86-64-so-2-and-why-can-it-be-used-to-execute-file https://unix.stackexchange.com/questions/400621/what-is-lib6... Anyway this whole discussion of "What if the admin was silly enough to think the execute bit did something?" is academic. If the attacker can run any binary that's already on the system as root, you've already lost.
  - pjmlp 5y ago
    For that they have to have the rights to actually replace tcpdump, so it is already owned anyway.
    - NavinF 5y ago
      No, the stock tcpdump works just fine for this attack. You were replying to a guy talking about this scenario where the attacker can run tcpdump as root: >So if you are trying to privilege escalate a linux box and sudo -l returns: (root) /usr/sbin/tcpdump
      - pjmlp 5y ago
        Except you missed the part "swap the tcpdump savefile", which one then needs to execute somehow. Complicated, when not given the rights to do so.
        creshal 5y ago
        The savefile is not the tcpdump executable.
        NavinF 5y ago
        Swapping the file is as easy as running "mv ./evil_binary ./savefile". This is all happening in the home directory. evil_binary can written using "echo -n -e" You can take as much time as you want to do the swap. tcpdump will only run the log-rotate program you specified after the time limit you specified has passed. I find it baffling that you think this is a complicated exploit. It's literally the first thing I thought of, and I'm just a random programmer. A real attacker would have a lot more tricks up their sleeve and all the time in the world to google solutions to problems like this. Does your threat model assume that the attacker doesn't know how to use a terminal?
        pjmlp 5y ago
        Home is mounted as noexec. Sure when there is a will, there is a way, however it seems many here lack the experience to work on properly locked down UNIX servers, where a user is really a plain user that dances to IT music tune.
        NavinF 5y ago
        > Home is mounted as noexec. Dude we just had a whole conversation about why this does fuck-all if you allow users to run commands like tcpdump as root. Your "properly locked down UNIX servers" are just placebo. I gotta wonder if I'm responding to an elaborate reenactment of the 90s. In what universe are "plain users" running commands on a unix server, let alone a server run by a BOFH that blocks +x, but is totally fine with root escalation?

pjmlp 5y ago

If the server admin was dumb enough to allow executables on $HOME, or anywhere where the user has write access.

NavinF 5y ago
Why would the attacker need to set the execute bit on the file they want to execute? Can't they just run "tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z /lib64/ld-linux-x86-64.so.2" and then swap the tcpdump savefile with the file they want to execute? That will run "ld-linux-x86-64.so.2 ./savefile" after a few seconds which is the same thing as running "chmod +x savefile; ./savefile" https://unix.stackexchange.com/questions/400621/what-is-lib64-ld-linux-x86-64-so-2-and-why-can-it-be-used-to-execute-file https://unix.stackexchange.com/questions/400621/what-is-lib6... Anyway this whole discussion of "What if the admin was silly enough to think the execute bit did something?" is academic. If the attacker can run any binary that's already on the system as root, you've already lost.
- pjmlp 5y ago
  For that they have to have the rights to actually replace tcpdump, so it is already owned anyway.
  - NavinF 5y ago
    No, the stock tcpdump works just fine for this attack. You were replying to a guy talking about this scenario where the attacker can run tcpdump as root: >So if you are trying to privilege escalate a linux box and sudo -l returns: (root) /usr/sbin/tcpdump
    - pjmlp 5y ago
      Except you missed the part "swap the tcpdump savefile", which one then needs to execute somehow. Complicated, when not given the rights to do so.
      - creshal 5y ago
        The savefile is not the tcpdump executable.
      - NavinF 5y ago
        Swapping the file is as easy as running "mv ./evil_binary ./savefile". This is all happening in the home directory. evil_binary can written using "echo -n -e" You can take as much time as you want to do the swap. tcpdump will only run the log-rotate program you specified after the time limit you specified has passed. I find it baffling that you think this is a complicated exploit. It's literally the first thing I thought of, and I'm just a random programmer. A real attacker would have a lot more tricks up their sleeve and all the time in the world to google solutions to problems like this. Does your threat model assume that the attacker doesn't know how to use a terminal?
        pjmlp 5y ago
        Home is mounted as noexec. Sure when there is a will, there is a way, however it seems many here lack the experience to work on properly locked down UNIX servers, where a user is really a plain user that dances to IT music tune.
        NavinF 5y ago
        > Home is mounted as noexec. Dude we just had a whole conversation about why this does fuck-all if you allow users to run commands like tcpdump as root. Your "properly locked down UNIX servers" are just placebo. I gotta wonder if I'm responding to an elaborate reenactment of the 90s. In what universe are "plain users" running commands on a unix server, let alone a server run by a BOFH that blocks +x, but is totally fine with root escalation?