[Full-Disclosure] /bin/rm file access vulnerability

From: Lennart Hansen (xenzeo_at_gardener.com)
Date: 12/30/04

  • Next message: J. Oquendo: "[Full-Disclosure] Trivial Bug in Symantec Security Products" 
    To: full-disclosure@lists.netsys.com
Date: Wed, 29 Dec 2004 20:18:25 -0500

    /bin/rm file access vulnerability

    Affected Products:
             /bin/rm (all versions, tested on FreeBSD and linux)
             (http://www.freebsd.org http://www.kernel.org)

    Author:
             Xenzeo (Ablazed, Ultralaser, Lennart A. Hansen)
             xenzeo at blackhat dot dk

    /bin/rm is a program that removes the named file arguments on unix systems.
    When /bin/rm is called it checks the file's permissions and the id of the user
    trying to remove the file. If the user does not have the required permissions
    to delete the file, /bin/rm will simply reject and exit.

    However, it is possible for a person with admin rights (root) to
    delete _any_ file
    on the system regardless of who has created it and what it's permissions are.

    Proof of concepts:
    $ touch /home/xenzeo/file
    $ ls -l /home/xenzeo/file
    -rw-r--r-- 1 xenzeo none 0 Dec 30 2004 /home/xenzeo/file
    $ id
    uid=1000(xenzeo) gid=513(none) groups=513(none),545(users)
    $ su -c 'rm -f /home/xenzeo/file'
    $ ls -l /home/xenzeo/file
    ls: file: No such file or directory

    #!/usr/bin/perl
    if ($#ARGV != 0) {
            die "usage: rm-exploit.pl file\r\n";
    } else {
        $file = $ARGV[0];
        print "*** CMD: [ /bin/rm -f $file ]\r\n";
        print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
        if ($> == 0) {
           print "[-] EXECUTING CMD\r\n";
           system("/bin/rm -f $file");
           print "[-] DONE\r\n";
           print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
           exit();
        } else {
           print "[-] EXPLOIT FAILED\r\n";
           print "[-] YOU ARE NOT ROOT\r\n";
           print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
        }
    }

    Vender status:
             Neither FreeBSD nor Linux developers have been contacted yet!

    -Xenzeo 

    -- 
___________________________________________________________
Sign-up for Ads Free at Mail.com
http://promo.mail.com/adsfreejump.htm
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: J. Oquendo: "[Full-Disclosure] Trivial Bug in Symantec Security Products"

    Relevant Pages