Re: Why SUID Binary exploit does not yield root shell?

From: Shaun Clowes (shaun@securereality.com.au)
Date: 03/09/03

  • Next message: buzzdee: "Re: Why SUID Binary exploit does not yield root shell?" 
    Date: Sun, 09 Mar 2003 18:56:58 +1100
To: Kryptik Logik <kryptiklogik@hushmail.com>, vuln-dev@securityfocus.com
From: Shaun Clowes <shaun@securereality.com.au>

    Hi Kryptik,

    >I've managed to find a buffer overflow and exploit it to exeve a /bin/sh
    >using my payload shellcode. However, whenever I run my exploit, I do get a
    >shell but just that it is an ordinary shell under my account (as id would
    >indicate).

    It's quite likely that the program in question is dropping privileges
    before the buffer overflow occurs. To determine if that's the case try
    modifying your shellcode to perform a trap (INT3, 0xcc) and run the exploit
    under the debugger. When the shellcode executes the program should stop.
    Then you can just look in /proc/<pid>/status, the ids on the "Uid:" line
    represent the real, effective, saved and filesystem user ids respectively.
    If these are all no longer root, there is nothing you can do to restore
    privileges.

    One other way to determine if the program is dropping privileges would be
    to run strace on the binary and see if set(re)uid has been called before
    the overflow point.

    Cheers,
    Shaun

  • Next message: buzzdee: "Re: Why SUID Binary exploit does not yield root shell?"

    Relevant Pages

    • Re: OT? Are chroots immune to buffer overflows?
      ... There has also been shellcode which will listen on a port, ... which it will then execute as shell code thus nullifying the need to have ... > The buffer overflow still works as expected (the bug is in the daemon, ...
      (Vuln-Dev)
    • Stack and Buffer Overflow Confusion
      ... at the moment I read a book called "Forbitten Code". ... the own computer with help of a buffer overflow. ... Then I saved the shellcode to a variable SHELLCODE, ...
      (comp.lang.asm.x86)
    • RE: What does the code mean?
      ... Shellcode, which is used in a buffer overflow exploit. ... resource on this... ... Stephane Auger ...
      (Security-Basics)
    • Stack Confusion with Buffer Overflow
      ... at the moment I read a book called "Forbitten Code". ... the own computer with help of a buffer overflow. ... Then I saved the shellcode to a variable SHELLCODE, ...
      (comp.unix.programmer)
    • Re: OT? Are chroots immune to buffer overflows?
      ... I've heard of shellcode that supposedly jumps out of the chroot jail, ... it's probably been fixed now (whatever bug in chroot the shellcode ... The buffer overflow would work ... dropped a bash shell in there:) ...
      (Vuln-Dev)