4 ms·

Loopholes of this kind exist these days as well. When I was working for a major retailer, who, you'd assume would have thought about these things well enough,

Loopholes of this kind exist these days as well. When I was working for a major retailer, who, you'd assume would have thought about these things well enough, you were prevented from executing sudo, except for being able to use it for text editing (sudo vi). I needed to install some packages with a root shell at the time, so I used the command execution feature within vi to get that.

netsharc 2y ago
In the Middle Ages, when Internet access wasn't in your pocket all the time, I was in a hostel which had Internet kiosks, you'd put a coin in a machine, and the PC would start 2 browser windows: 1 with just a countdown, and one for you to browse. You'd have to put more coins or when the time ends the browser would be killed. Of course there was nothing else in the UI except this window and the browser, but on ancient Firefox, in the print window you had the option to specify the command line to print. I tried "xterm", hit "Print", and voila, a prompt! Using ps, I managed to figure out the difference between the unpaid browser and the paid one, and next time around I could launch a browsing session without payment...
- lostlogin 2y ago
  This is excellent, and while I’m guessing that you could have paid, browsed and moved on with less effort, that wasn’t the point.
  - fargle 2y ago
    that's pretty low effort, so not really. but cool. win-win.
tiberious726 2y ago
My favorite is pressing '!' while inside a sudoed or setuid less.
denysvitali 2y ago
There's a collection of these binary escapes: https://gtfobins.github.io/ https://gtfobins.github.io/
more_corn 2y ago
I once encountered a good anti sudo control. Execute sudo and you get a warning “log in as root instead!” Firstly, no Secondly did you just “prevent” sudo by aliasing it?
raffraffraff 2y ago
Not too mention that you can edit anything you want, like the sudoers file.
akimbostrawman 2y ago
I would assume sudoedit could have preventing that
mingus88 2y ago
As someone who used to sysadmin and was well aware of this trick, sometimes a developer or dba will bully their way through leadership to make sure they never need to ask for permission to edit their configs We all knew it was a bad idea but when your boss and their boss say do it, it’s done. I’m pretty sure the dba (autocorrect magically suggested “diva” here) knew as well and just wanted a backdoor to have root for whatever they wanted. I later busted the same team applying patches out of band with tripwire. Hey, wonder how you pulled that off…
- NewJazz 2y ago
  Why were they applying patches? And what were they patching? What were the consequences when you busted them?
  - mingus88 2y ago
    These were solaris 8 or 9 patches for some Oracle DB. Patch management back then was wild and conflicting patches could cause problems. Of course there were no consequences for someone bypassing the approval process and doing unscheduled changes as root. Now, if my team had made those changes without running it past the DBAs...
- fargle 2y ago
  they only needed a backdoor root because you're a gatekeeping dick and they wanted to get their job done without having to "deal" with your shit. OMG. they applied unapproved patches! to the product they were responsible for making work.
  - mingus88 2y ago
    lol, restricting administrative access to the administrators is pretty much a security best practice in every company everywhere. Ever heard of the principle of least privilege? They didn’t give me admin in the database and I don’t want it. They aren’t trained in the system and if you’ve ever seen what kind of mess a bunch of amateurs can make of a shared system you wouldn’t sound like such an idiot right now Ill be sure to tell the auditors that they are gatekeeping dicks for requiring change management on the financial databases
FergusArgyll 2y ago
That's like a beginner level CTF! sheesh
saagarjha 2y ago
My high school computer lab had an incredibly incompetent admin whose idea of security was to look through the bash history of problem students and go from there. Anyway, at one point they decided that someone had used cp to copy things to places they should’ve have been (did I mention they didn’t really understand UNIX permissions?) they decided to just remove cp altogether. So of course I made a fake cp (in Java, because that was all I knew at the time) to replace it.

netsharc 2y ago

In the Middle Ages, when Internet access wasn't in your pocket all the time, I was in a hostel which had Internet kiosks, you'd put a coin in a machine, and the PC would start 2 browser windows: 1 with just a countdown, and one for you to browse. You'd have to put more coins or when the time ends the browser would be killed. Of course there was nothing else in the UI except this window and the browser, but on ancient Firefox, in the print window you had the option to specify the command line to print. I tried "xterm", hit "Print", and voila, a prompt! Using ps, I managed to figure out the difference between the unpaid browser and the paid one, and next time around I could launch a browsing session without payment...

lostlogin 2y ago
This is excellent, and while I’m guessing that you could have paid, browsed and moved on with less effort, that wasn’t the point.
- fargle 2y ago
  that's pretty low effort, so not really. but cool. win-win.

tiberious726 2y ago

My favorite is pressing '!' while inside a sudoed or setuid less.

denysvitali 2y ago

There's a collection of these binary escapes: https://gtfobins.github.io/ https://gtfobins.github.io/

more_corn 2y ago

I once encountered a good anti sudo control. Execute sudo and you get a warning “log in as root instead!” Firstly, no Secondly did you just “prevent” sudo by aliasing it?

raffraffraff 2y ago

Not too mention that you can edit anything you want, like the sudoers file.

akimbostrawman 2y ago

I would assume sudoedit could have preventing that

mingus88 2y ago

As someone who used to sysadmin and was well aware of this trick, sometimes a developer or dba will bully their way through leadership to make sure they never need to ask for permission to edit their configs We all knew it was a bad idea but when your boss and their boss say do it, it’s done. I’m pretty sure the dba (autocorrect magically suggested “diva” here) knew as well and just wanted a backdoor to have root for whatever they wanted. I later busted the same team applying patches out of band with tripwire. Hey, wonder how you pulled that off…

NewJazz 2y ago
Why were they applying patches? And what were they patching? What were the consequences when you busted them?
- mingus88 2y ago
  These were solaris 8 or 9 patches for some Oracle DB. Patch management back then was wild and conflicting patches could cause problems. Of course there were no consequences for someone bypassing the approval process and doing unscheduled changes as root. Now, if my team had made those changes without running it past the DBAs...
fargle 2y ago
they only needed a backdoor root because you're a gatekeeping dick and they wanted to get their job done without having to "deal" with your shit. OMG. they applied unapproved patches! to the product they were responsible for making work.
- mingus88 2y ago
  lol, restricting administrative access to the administrators is pretty much a security best practice in every company everywhere. Ever heard of the principle of least privilege? They didn’t give me admin in the database and I don’t want it. They aren’t trained in the system and if you’ve ever seen what kind of mess a bunch of amateurs can make of a shared system you wouldn’t sound like such an idiot right now Ill be sure to tell the auditors that they are gatekeeping dicks for requiring change management on the financial databases

FergusArgyll 2y ago

That's like a beginner level CTF! sheesh

saagarjha 2y ago

My high school computer lab had an incredibly incompetent admin whose idea of security was to look through the bash history of problem students and go from there. Anyway, at one point they decided that someone had used cp to copy things to places they should’ve have been (did I mention they didn’t really understand UNIX permissions?) they decided to just remove cp altogether. So of course I made a fake cp (in Java, because that was all I knew at the time) to replace it.