3 ms·

> 4. set the binary to have 4755 permissions with owner as root:root. If you can do this, you already have root access. If you have root access, then you don't

> 4. set the binary to have 4755 permissions with owner as root:root. If you can do this, you already have root access. If you have root access, then you don't need dirty tricks to get root access. Additionally, in the three minutes that I spent searching, I found a bunch of evidence that indicated that TrueCrypt volumes mounted through FUSE are mounted with the nosuid option. (Ferinstance, search for 'nosuid' here: http://www.reddit.com/r/archlinux/comments/1fcwvr/truecrypt_volumes_will_not_dismount_volume/ http://www.reddit.com/r/archlinux/comments/1fcwvr/truecrypt_... )

mhogomchungu 12y ago
Reads the instructions again At step 4,you create the volume on the computer you have root access(a home computer for example),copy the program and set up necessary permission on the program At step 5,you take the "hot" volume to another computer where you do not have root access to(like a friend's computer).On this friend computer,you open the "hot" volume and then run the suid-root program to gain root shell or run any other root command your prefer. In a nutshell,if you are on linux and you have TrueCrypt installed,give me your computer to open my TrueCrypt volume and i can get root shell in seconds.No kidding. The link i provided gave source code to test the exploit,if you cant or prefer not to,the check below link that speaks of the same exploit http://vinicius777.github.io/blog/2014/07/14/truecrypt-privilege-escalation/ http://vinicius777.github.io/blog/2014/07/14/truecrypt-privi...
- simoncion 12y ago
  I cannot repro. See this transcript: http://pastebin.com/y958QtWh http://pastebin.com/y958QtWh By the way: $ man mount MOUNT(8) System Administration MOUNT(8) NAME mount - mount a filesystem SYNOPSIS <snip> defaults Use default options: rw, suid, dev, exec, auto, nouser, and async. <snip>
  - mhogomchungu 12y ago
    Its because you overrode the default option of "suid" with your "nosuid" when mounting.TrueCrypt does not do this and that is where the problem is. To reproduce the problem,use TrueCrypt with its default mount options,or do your mounting with mount's default options. The fundamental problem is a bad usage of mount command that comes from usage of mount's default options.You cant reproduce the problem because you changed a bad default option to a good one.
    - simoncion 12y ago
      > The fundamental problem is ... mount's default options. This is exactly my point. You might as well complain to Ted Ts'o about the same vulnerability in ext4. Please do reply to my comment here: https://news.ycombinator.com/item?id=8060884 https://news.ycombinator.com/item?id=8060884

mhogomchungu 12y ago

Reads the instructions again At step 4,you create the volume on the computer you have root access(a home computer for example),copy the program and set up necessary permission on the program At step 5,you take the "hot" volume to another computer where you do not have root access to(like a friend's computer).On this friend computer,you open the "hot" volume and then run the suid-root program to gain root shell or run any other root command your prefer. In a nutshell,if you are on linux and you have TrueCrypt installed,give me your computer to open my TrueCrypt volume and i can get root shell in seconds.No kidding. The link i provided gave source code to test the exploit,if you cant or prefer not to,the check below link that speaks of the same exploit http://vinicius777.github.io/blog/2014/07/14/truecrypt-privilege-escalation/ http://vinicius777.github.io/blog/2014/07/14/truecrypt-privi...

simoncion 12y ago
I cannot repro. See this transcript: http://pastebin.com/y958QtWh http://pastebin.com/y958QtWh By the way: $ man mount MOUNT(8) System Administration MOUNT(8) NAME mount - mount a filesystem SYNOPSIS <snip> defaults Use default options: rw, suid, dev, exec, auto, nouser, and async. <snip>
- mhogomchungu 12y ago
  Its because you overrode the default option of "suid" with your "nosuid" when mounting.TrueCrypt does not do this and that is where the problem is. To reproduce the problem,use TrueCrypt with its default mount options,or do your mounting with mount's default options. The fundamental problem is a bad usage of mount command that comes from usage of mount's default options.You cant reproduce the problem because you changed a bad default option to a good one.
  - simoncion 12y ago
    > The fundamental problem is ... mount's default options. This is exactly my point. You might as well complain to Ted Ts'o about the same vulnerability in ext4. Please do reply to my comment here: https://news.ycombinator.com/item?id=8060884 https://news.ycombinator.com/item?id=8060884