Re: Red Hat 9: free tickets

From: Jon Hart (warchild_at_spoofed.org)
Date: 07/11/03

  • Next message: ph1zzle: "Re: How vulnerable is a 'Limited" account on XP?" 
    Date: Fri, 11 Jul 2003 13:48:07 -0400
To: Stephen Samuel <samuel@bcgreen.com>

    On Sun, Jul 06, 2003 at 12:30:34PM -0700, Stephen Samuel wrote:
    > The way it works is:
    >
    > ln -s /var/run/sudo/mylogin/0:root /tmp/likely_tmp_name
    >
    > Then you wait for or cause some setuid progrem to attempt to
    > (insecurely) write to /tmp/likely_tmp_name . When that happens,
    > /var/run/sudo/mylogin/0:root is created, and pam_timestamp_check
    > now allows you to run any helper application as if you'd
    > typed in the root password...
    >
    > Since these helper applicaitons tend to allow all sorts
    > of nasty work (like creating a uid=0 user), you've now got a
    > *serious* security violation on your hands.
    >
    > The face that /var/run/sudo is rwx root only is no protection
    > because the open is doen by an suid-root program, and the symlink
    > in /tmp can be created by anybody.
    >
    > Proof of concept:
    >
    > as youreslf:
    > ln -s /var/run/sudo/$USER/unknown:root /tmp/oops
    >
    > as root:
    > touch /tmp/oops
    >
    > as yourself: open the system-settings/users&groups utility from
    > the desktop menu.
    >
    > You can now create an account with uid=0
    >
    > Now ANY exploit that can cause a setuid/root program to create
    > an arbitrary file (regardless of content) can be used to create
    > an arbitrary root user.
    >
    > Finding such an exploit is left as an exercise for the user.

    Actually, I'm not sure this entirely true. Well, it is, but there is
    another important condition that must be met for this (or similar)
    attacks to work properly -- /var/run/sudo/$USER/ must exist. This means
    that the user must have previously sudo'd at lease once and
    /var/run/sudo/$USER/ will have been created.

    I'm sure there are ways to work around this, but in my experiments,
    /var/run/sudo/$USER/ must exist if you hope to exploit something like
    this with the predictable file name creation + symlink trick.

    -jon

  • Next message: ph1zzle: "Re: How vulnerable is a 'Limited" account on XP?"

    Relevant Pages

    • Re: Red Hat 9: free tickets
      ... > Then you wait for or cause some setuid progrem to attempt to ... > now allows you to run any helper application as if you'd ... > typed in the root password... ... > an arbitrary file can be used to create ...
      (Bugtraq)
    • Re: Red Hat 9: free tickets
      ... Then you wait for or cause some setuid progrem to attempt to ... The face that /var/run/sudo is rwx root only is no protection ... > This way of attack seems useless to me. ... would create a reasonably high barrier to entry for any hacker ...
      (Vuln-Dev)
    • Re: unix and email viruses
      ... with root privileges. ... The exploit would have to be one that gets root privileges through ... _thing_, data or code, that causes a privilege escalation. ... have to be a helper running as root, just a helper that can be ...
      (Debian-User)
    • "intermodule-global" variables
      ... I am having a problem with an application I am writing: ... In the helper module I want to access the root variable, ... def printa(): ...
      (comp.lang.python)