Re: [Full-Disclosure] /bin/rm file access vulnerability

From: Sean Harlow (sharlow_at_UTNet.UToledo.Edu)
Date: 12/30/04

  • Next message: Marc Maiffret: "RE: [Full-Disclosure] Multiple Backdoors found in eEye Products (IRISand SecureIIS)" 
    Date: Wed, 29 Dec 2004 21:17:12 -0500
To: full-disclosure@lists.netsys.com

    Is this a joke?

    root can delete any file...isn't that the point of being root? the fact
    that you can do anything with the system, regardless of permissions?

    -Sean

    Lennart Hansen wrote:
    > /bin/rm file access vulnerability
    >
    > Affected Products:
    > /bin/rm (all versions, tested on FreeBSD and linux)
    > (http://www.freebsd.org http://www.kernel.org)
    >
    > Author:
    > Xenzeo (Ablazed, Ultralaser, Lennart A. Hansen)
    > xenzeo at blackhat dot dk
    >
    >
    > /bin/rm is a program that removes the named file arguments on unix systems.
    > When /bin/rm is called it checks the file's permissions and the id of the user
    > trying to remove the file. If the user does not have the required permissions
    > to delete the file, /bin/rm will simply reject and exit.
    >
    > However, it is possible for a person with admin rights (root) to
    > delete _any_ file
    > on the system regardless of who has created it and what it's permissions are.
    >
    > Proof of concepts:
    > $ touch /home/xenzeo/file
    > $ ls -l /home/xenzeo/file
    > -rw-r--r-- 1 xenzeo none 0 Dec 30 2004 /home/xenzeo/file
    > $ id
    > uid=1000(xenzeo) gid=513(none) groups=513(none),545(users)
    > $ su -c 'rm -f /home/xenzeo/file'
    > $ ls -l /home/xenzeo/file
    > ls: file: No such file or directory
    >
    > #!/usr/bin/perl
    > if ($#ARGV != 0) {
    > die "usage: rm-exploit.pl file\r\n";
    > } else {
    > $file = $ARGV[0];
    > print "*** CMD: [ /bin/rm -f $file ]\r\n";
    > print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
    > if ($> == 0) {
    > print "[-] EXECUTING CMD\r\n";
    > system("/bin/rm -f $file");
    > print "[-] DONE\r\n";
    > print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
    > exit();
    > } else {
    > print "[-] EXPLOIT FAILED\r\n";
    > print "[-] YOU ARE NOT ROOT\r\n";
    > print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
    > }
    > }
    >
    > Vender status:
    > Neither FreeBSD nor Linux developers have been contacted yet!
    >
    > -Xenzeo
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Marc Maiffret: "RE: [Full-Disclosure] Multiple Backdoors found in eEye Products (IRISand SecureIIS)"

    Relevant Pages

    • Re: samba shares unmountable by user
      ... Here is another example of why I run as root on the main box here, ... This is another example of why I use Gnome, regardless of how much ... [gene@coyote Pictures]$ id ... not sure about fuse & gfvsd. ...
      (Fedora)
    • Re: MapPath Strange behavior locally
      ... / is the root of your site, regardless of where ... you are, so when that path is translated to the file system, it is where the ... root of your site is. ... > and created a new virtual directory for it and make it point to the ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: MapPath Strange behavior locally
      ... / is the root of your site, regardless of where ... you are, so when that path is translated to the file system, it is where the ... root of your site is. ... > and created a new virtual directory for it and make it point to the ...
      (microsoft.public.inetserver.iis)
    • Re: samba shares unmountable by user
      ... Here is another example of why I run as root on the main box here, ... This is another example of why I use Gnome, regardless of how much ... [gene@coyote Pictures]$ id ... No manual entry for gvfs-mount ...
      (Fedora)
    • Re: MapPath Strange behavior locally
      ... / is the root of your site, regardless of where ... you are, so when that path is translated to the file system, it is where the ... root of your site is. ... > and created a new virtual directory for it and make it point to the ...
      (microsoft.public.inetserver.asp.general)