4 ms·
Are there any real examples of how this could be used to do something malicious?
by Retr0spectrum 11y ago
Are there any real examples of how this could be used to do something malicious?
- schoen 11y agoProbably strictfp's example above of allowing someone to run specific commands with sudo. In the past there were also various implementations of a "restricted shell"; it's conceivable that some of these could bypass a restricted shell's restrictions, depending on how they were implemented.
- tptacek 11y agoSure: any attempt to build a "sandboxed" command line interface with a shell, or any web app that shells out to one of these commands and passes user input as an argument.
- jlgaddis 11y agoIn one case, I could have used tcpdump to elevate privileges on a customer's router. They had an x86 box running RHEL as their firewall/router and I was hired to resolve an (IPSec) issue they were having. I asked for a capture of some specific traffic but their I.T. guys (small company w/ only two technical staff) weren't "fluent" with bpf filters, so they created a user account for me, provided me with access via SSH, and granted me the ability to run tcpdump via sudo. From the example given, I could have used the "-z" flag to run arbitrary commands and escalate to root (although, in this case, I likely could have gained root simply by asking nicely).