3 ms·

> So now $EVIL_USER puts "@reboot /home/$EVIL_USER/bind_port_2222" in his crontab, or some such other method of getting to port 2222 before the ssh daemon. I h

> So now $EVIL_USER puts "@reboot /home/$EVIL_USER/bind_port_2222" in his crontab, or some such other method of getting to port 2222 before the ssh daemon. I hadn't thought of this. Setting up the malicious executable to somehow bind to the SSH port before the SSH daemon is able to and then rebooting the computer - assuming the user has reboot privileges - seems to be the only way to do this correct? (Once the SSH daemon has bound to its assigned port, then I don't think the port matters - if the user is able to kill a root-owned SSH daemon, he's likely able to start his service on whatever port he wants).

AnthonyMouse 13y ago
> Setting up the malicious executable to somehow bind to the SSH port before the SSH daemon is able to and then rebooting the computer - assuming the user has reboot privileges - seems to be the only way to do this correct? Not necessarily. You wouldn't necessarily need reboot privileges, you could just wait until root reboots the machine for whatever unrelated reason (e.g. kernel update). And you could do the same thing with the daemon: Wait until some updated version of the daemon is released and when root is installing it there will be a race starting when the old version exits before the new version starts and binds the port. You're also just causing trouble for yourself because then you have to worry about a bunch of arcana like whether the daemon is using SO_REUSEADDR, IPV6_V6ONLY, only binding to the IPv4 address when the machine is dual stack, etc.