Re: how an hacker can bypass a chrooted environement ?

The most typical is to create a directory, open a file handle and then
chroot into that directory, then chdir'ing to the other directory,
then ../../ up until root and then calling chroot again. Then suppose
you can mount /proc, then you can cd to /proc/1/cwd. Or perhaps,
depending on the vulnerable service using already existing file
descriptors to fchdir() to freedom, what about mknod? shared memory?
unix sockets? signals? kernel exploits? et cetera.

I hope you are starting to get the point that chroot is a severly
flawed concept. Yes many people try to limit what exists inside a
jail, but that doesn't prevent me from uploading my own code through
one method or another.

On 5/12/06, alan <alan@xxxxxxxxxxxxxx> wrote:
On Fri, 12 May 2006, Norbert François wrote:

> Hi...
>
> I was wondering how an attacker can bypass a chrooted environement. A
> (common) technique consist in finding a vulnerable program (in the
> chrooted environnement) and injecting it a shellcode (i.e
> ../../../../../../../bin/bash for ex.) by BoF. But normally, in the
> chrooted environement, you volontarily add only necessary tools (like
> ls, cat, less...), and vulnerable softwares are uncommon...
>
> So... how do they this "exploit" of bypassing the chroot ?

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@xxxxxxxxxx for details.
------------------------------------------------------------------------------

Relevant Pages

  • Re: Q: Impact of globbing vulnerability in ftpd
    ... so ftpd is already chrooted and running with the uid of the user at ... sufficient to allow the vulnerability to be exploited. ... compounded because the FTP server only runs with an effective UID of the ... there are processes outside of the chroot() running as the same user. ...
    (FreeBSD-Security)
  • Re: how an hacker can bypass a chrooted environement ?
    ... chrooted environnement) and injecting it a shellcode (i.e ... This is called "breaking out of the chroot". ... the current WORKING directory is not changed -- it is OUTSIDE the root directory of the process. ... Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. ...
    (Pen-Test)
  • Re: how an hacker can bypass a chrooted environement ?
    ... Few months ago I tried to install a jail chroot with "jail" ... > I was wondering how an attacker can bypass a chrooted environement. ... Download FREE whitepaper on how a managed service can ...
    (Pen-Test)
  • RE: how an hacker can bypass a chrooted environement ?
    ... All this talk about chroot makes me wonder about xen or vmware...anyone have any thoughts/comments on breaking out of a virtual operating system? ... you need to proactively protect your applications from hackers. ... Download FREE whitepaper on how a managed service can ...
    (Pen-Test)
  • Re: how an hacker can bypass a chrooted environement ?
    ... I was wondering how an attacker can bypass a chrooted environement. ... testing and vulnerability management needs. ... Download FREE whitepaper on how a managed service can ...
    (Pen-Test)