4 ms·

No, the stock tcpdump works just fine for this attack. You were replying to a guy talking about this scenario where the attacker can run tcpdump as root: >So i

• pjmlp 5y ago
  Except you missed the part "swap the tcpdump savefile", which one then needs to execute somehow. Complicated, when not given the rights to do so.
  • creshal 5y ago
    The savefile is not the tcpdump executable.
  • NavinF 5y ago
    Swapping the file is as easy as running "mv ./evil_binary ./savefile". This is all happening in the home directory. evil_binary can written using "echo -n -e" You can take as much time as you want to do the swap. tcpdump will only run the log-rotate program you specified after the time limit you specified has passed. I find it baffling that you think this is a complicated exploit. It's literally the first thing I thought of, and I'm just a random programmer. A real attacker would have a lot more tricks up their sleeve and all the time in the world to google solutions to problems like this. Does your threat model assume that the attacker doesn't know how to use a terminal?
    • pjmlp 5y ago
      Home is mounted as noexec. Sure when there is a will, there is a way, however it seems many here lack the experience to work on properly locked down UNIX servers, where a user is really a plain user that dances to IT music tune.
      • NavinF 5y ago
        > Home is mounted as noexec. Dude we just had a whole conversation about why this does fuck-all if you allow users to run commands like tcpdump as root. Your "properly locked down UNIX servers" are just placebo. I gotta wonder if I'm responding to an elaborate reenactment of the 90s. In what universe are "plain users" running commands on a unix server, let alone a server run by a BOFH that blocks +x, but is totally fine with root escalation?
      • anthk 5y ago
        Man, not so long ago it was trivial to get a shell from a restricted one on a pretty infamous pubnix...