3 ms·
On my system, all SUID binaries are executable yet not readable, e.g. $ ls -l /bin/su -rws--x--x 1 root root 52144 Mar 5 2011 /bin/su Doesn't this effec
by kmm 15y ago
On my system, all SUID binaries are executable yet not readable, e.g.
$ ls -l /bin/su
-rws--x--x 1 root root 52144 Mar 5 2011 /bin/su
Doesn't this effectively stop the exploit? It still works when I insert the <exit@plt> function address, but I don't think it's possible to trace this without root rights, which kind of defeats the purpose.
- rzhou 15y agoIt doesn't stop the exploit, as it is still possible to use ptrace to essentially dump the binary, even though it's not readable.
- ahv 15y agoOr if you know the distro, it is trivial to get the package containing the su executable and locate the address.
- kmm 15y agoI compiled it myself, so that is not an option.
- burgerbrain 15y agoPresumably they only need to guess the flags you used then. There is really not all that much entropy there. And I suspect doing so is fairly uncommon in production environments anyway.