Re: Strange command histories in hacked shell history

From: Peter C. Lai (sirmoo_at_cowbert.net)
Date: 12/17/04

  • Next message: Bill Vermillion: "Re: Strange command histories in hacked shell history" 
    Date: Fri, 17 Dec 2004 10:03:24 -0500
To: Bill Vermillion <bv@wjv.com>

    I thought on BSD, there was no distinction between euid and uid. If you login
    as user 'foo', and su to 'bar', your uid is bar and you gain all of "bar"'s
    privs.

    On Fri, Dec 17, 2004 at 09:53:15AM -0500, Bill Vermillion wrote:
    > > Message: 1
    > > Date: Thu, 16 Dec 2004 20:31:05 +0800
    > > From: Ganbold <ganbold@micom.mng.net>
    > > Subject: Strange command histories in hacked shell server
    >
    > Just a minor comment on one portion of your message.
    >
    > [All deleted except the pertinent part - wjv]
    >
    > > Machine is configured in such way that everyone can create an account itself.
    > > Some user dir permissions:
    > > ...
    > > drwxr-xr-x 2 root wheel 512 Mar 29 2004 new
    > > drwx------ 3 tamiraad unix 512 Apr 9 2004 tamiraad
    > > drwxr-xr-x 6 tsgan tsgan 1024 Dec 16 17:51 tsgan
    > > drwx------ 4 tugstugi unix 512 Dec 13 20:34 tugstugi
    > > drwxr-xr-x 5 unix unix 512 Dec 13 12:37 unix
    > > ...
    > > User should log on as new with password new to create an account.
    >
    > > Accounting is enabled and kern.securelevel is set to 2. Only one
    > > account 'tsgan' is in wheel group and only tsgan gan become root
    > > using su.
    >
    > I've asked others before and never got a real answer on the design
    > of 'su' which to my way of thinking has a security hold that shold
    > be fixed.
    >
    > su checks the EUID of the user to see if they are in 'wheel' to
    > enable them to su to root. It would seem to me it should
    > use the UID.
    >
    > In your case if the 'tsgan' account does not have a secure
    > password, and some breaches the 'tsgan' account in any manner, such
    > as a SUID tsgan as I see it, then that user who cracked the 'tsgan'
    > account can su to root.
    >
    > So in your case there is the possibility that someone else
    > su'ed to 'tsgan' and then su'ed to root.
    >
    > Can anyone explain why su does not use the UID from the login
    > instead of the EUID ? It strikes me as a security hole, but I'm no
    > security expert so explanations either way would be welcomed.
    >
    > Bill
    >
    >
    > --
    > Bill Vermillion - bv @ wjv . com
    > _______________________________________________
    > freebsd-security@freebsd.org mailing list
    > http://lists.freebsd.org/mailman/listinfo/freebsd-security
    > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" 

    -- 
Peter C. Lai
University of Connecticut
Dept. of Molecular and Cell Biology
Yale University School of Medicine
SenseLab | Research Assistant
http://cowbert.2y.net/
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
  • Next message: Bill Vermillion: "Re: Strange command histories in hacked shell history"

    Relevant Pages

    • Re: Question about SELinux and root privs
      ... "root" is just a normal user now, ... Yep, UID 0 of course, the username doesn't matter. ... > Well one of the points of SELinux seems to be there isn't any ... > account, and/or add/modify any privileges at will ... ...
      (comp.os.linux.security)
    • Re: error
      ... > and when i tried to log in i could not get into my account ... the system is only interested in your UID. ... the corresponding username it displays the UID. ... Use 'chown' as root to give your user the files you want back. ...
      (alt.os.linux.suse)
    • Re: error
      ... > and when i tried to log in i could not get into my account ... the system is only interested in your UID. ... the corresponding username it displays the UID. ... Use 'chown' as root to give your user the files you want back. ...
      (alt.os.linux)
    • RE: passwd
      ... to have the same UID, let alone the same UID of 0?! ... If they try with the passwd ... I've got RHEL3 update 5 and on my system if I create a new account ... unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe ...
      (RedHat)
    • Re: Why SUID Binary exploit does not yield root shell?
      ... Some /bin/sh's will drop privs if uid!= euid. ... Bash is being "smarter" than you want it to be. ...
      (Vuln-Dev)