bugtraq - Re: Sudo tricks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060326032516.GM11332@tunican.local>
Date: Sat, 25 Mar 2006 22:25:16 -0500
From: Kyle Wheeler <kyle-bugtraq@...oryhole.net>
To: bugtraq@...urityfocus.com
Subject: Re: Sudo tricks

On Friday, March 24 at 07:05 PM, quoth Dave Korn:
>> Here is a simple hack to break sudo and su to get free root. Add 
>> this to ~/.bashrc and fill in the following blanks:
>>
>> * ~/.root_kit/rk_su
>>  Your hacked su to give root on su --now-dammit
>> * ~/.root_kit/silent_install_root_kit
>>  Your script to silently install rk_su over /bin/su and add SUID to
>> it.
>
>  So, in other words, all you need in order to get root access is a 
>  rootkit, your shell script, and root access?  Ummm... I don't get 
>  it.

More precisely, if I have access to your bashrc and you have access to 
sudo, I can give myself permanent root access (I don’t need to know 
your password).

~Kyle
-- 
Well, I've wrestled with reality for over thirty five years, doctor, and 
I'm happy to state I finally won out over it.
                                           -- Jimmy Stewart, in "Harvey"

Content of type "application/pgp-signature" skipped