4 ms·

Isn’t this still actually wormable to some degree? Just among system you have access too. But imagine if any of those at all are shared…

theamk 2y ago
This can only propagate to other users if you are superuser on host and used "sudo". So yes, they will definitely propagate for a bit, but they won't go very far unless it's a very unusual environment.
- buildbot 2y ago
  Shared lab machines come to mind! Often many people have sudo and sometimes there is just one shared account.
  - fullspectrumdev 2y ago
    With some additional tricks, lab machines at universities would be fertile soil for such.
  - theamk 2y ago
    Do people actually have lab machines with shared accounts and everyone having sudo access? This sounds horrifying.. students do want to experiment, and it's enough for a single person to install gcc-5 as system compiler to ruin everyone's day. Surely the sysadmins are doing something to prevent this? Like NFS root or at least "no sudo access" by default?
    - buildbot 2y ago
      Good point,, in school the undergrad lab machines where very locked down and secure. In grad school, every prof had their own few machines in the lab that where shared, limited sudo access to me, I'm sure some shared the machines more openly. At work though, our lab machines that are not cloud based are shared across the team, everyone has sudo. They get broken all the time whenever someone decides they need a different cuda version. I've brought it up as an issue but nobody really cares haha.
cryptonector 2y ago
TFA's unicorns.so would still work today.
fullspectrumdev 2y ago
Yes. https://thc.org/ssh-it/ https://thc.org/ssh-it/ being a more recent implementation of the same concept, using $PATH modification instead of LD_PRELOAD. It also has some other optional tricks such as searching for unprotected SSH keys and the likes. This kind of thing can be deeply interesting to run in environments where developers share things like jump boxes, to determine the “blast radius” of a compromised account over time as part of a security exercise.

theamk 2y ago

This can only propagate to other users if you are superuser on host and used "sudo". So yes, they will definitely propagate for a bit, but they won't go very far unless it's a very unusual environment.

buildbot 2y ago
Shared lab machines come to mind! Often many people have sudo and sometimes there is just one shared account.
- fullspectrumdev 2y ago
  With some additional tricks, lab machines at universities would be fertile soil for such.
- theamk 2y ago
  Do people actually have lab machines with shared accounts and everyone having sudo access? This sounds horrifying.. students do want to experiment, and it's enough for a single person to install gcc-5 as system compiler to ruin everyone's day. Surely the sysadmins are doing something to prevent this? Like NFS root or at least "no sudo access" by default?
  - buildbot 2y ago
    Good point,, in school the undergrad lab machines where very locked down and secure. In grad school, every prof had their own few machines in the lab that where shared, limited sudo access to me, I'm sure some shared the machines more openly. At work though, our lab machines that are not cloud based are shared across the team, everyone has sudo. They get broken all the time whenever someone decides they need a different cuda version. I've brought it up as an issue but nobody really cares haha.

cryptonector 2y ago

TFA's unicorns.so would still work today.

fullspectrumdev 2y ago

Yes. https://thc.org/ssh-it/ https://thc.org/ssh-it/ being a more recent implementation of the same concept, using $PATH modification instead of LD_PRELOAD. It also has some other optional tricks such as searching for unprotected SSH keys and the likes. This kind of thing can be deeply interesting to run in environments where developers share things like jump boxes, to determine the “blast radius” of a compromised account over time as part of a security exercise.