full-disclosure - /bin/rm file access vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20041230054650.6a8fd8a7.vh@helith.net>
From: vh at helith.net (vh)
Subject: /bin/rm file access vulnerability

I wont say anything so just enjoy this:

$ cd /tmp
$ ls
hydra-4.4-src              sylpheed-1000
hydra-4.4-src.tar.gz       xmms_rembrandt.0
$ rm -rf *
$ ls
$ touch ProofOfDumbness
$ ls -la
total 20
drwxrwxrwt   4 root       wheel      512 Dec 30 05:39 .
drwxr-xr-x  15 root       wheel      512 Dec 16 11:13 ..
drwxrwxrwt   2 root       wheel      512 Dec 30 01:21 .ICE-unix
-r--r--r--   1 rembrandt  rembrandt   11 Dec 30 02:28 .X0-lock
drwxrwxrwt   2 root       wheel      512 Dec 30 02:28 .X11-unix
-rw-r--r--   1 rembrandt  wheel        0 Dec 30 05:39 ProofOfDumbness
$ su                                                                    
      
Password:
# chflags schg ProofOfDumbness                                          
#       
# ls -la
total 20
drwxrwxrwt   4 root       wheel      512 Dec 30 05:39 .
drwxr-xr-x  15 root       wheel      512 Dec 16 11:13 ..
drwxrwxrwt   2 root       wheel      512 Dec 30 01:21 .ICE-unix
-r--r--r--   1 rembrandt  rembrandt   11 Dec 30 02:28 .X0-lock
drwxrwxrwt   2 root       wheel      512 Dec 30 02:28 .X11-unix
-rw-r--r--   1 rembrandt  wheel        0 Dec 30 05:39 ProofOfDumbness
# rm ProofOfDumbness                                                    
#       
override rw-r--r--  rembrandt/wheel for ProofOfDumbness? y
rm: ProofOfDumbness: Operation not permitted
# id
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty),
5(operator), 20(staff), 31(guest)
# chflags noschg ProofOfDumbness
chflags: ProofOfDumbness: Operation not permitted
# hrhr... :-]

Even r00t can't delete all if he don't know what to do.
If you've any questions feel free to buy a UNIX Administrator Handbook
or start using manpages.

vH



> Is this a joke?
> 
> root can delete any file...isn't that the point of being root?  the
> fact that you can do anything with the system, regardless of
> permissions?
> 
> -Sean
> 
> Lennart Hansen wrote:
> > /bin/rm file access vulnerability
> > 
> > Affected Products:
> >          /bin/rm (all versions, tested on FreeBSD and linux)
> >          (http://www.freebsd.org    http://www.kernel.org)
> > 
> > Author:
> >          Xenzeo (Ablazed, Ultralaser, Lennart A. Hansen)
> >          xenzeo at blackhat dot dk
> > 
> > 
> > /bin/rm is a program that removes the named file arguments on unix
> > systems. When /bin/rm is called it checks the file's permissions and
> > the id of the user trying to remove the file. If the user does not
> > have the required permissions to delete the file, /bin/rm will
> > simply reject and exit.
> > 
> > However, it is possible for a person with admin rights (root) to 
> > delete _any_ file
> > on the system regardless of who has created it and what it's
> > permissions are.
> > 
> > Proof of concepts:
> > $ touch /home/xenzeo/file
> > $ ls -l /home/xenzeo/file
> > -rw-r--r--  1 xenzeo none 0 Dec 30  2004 /home/xenzeo/file
> > $ id
> > uid=1000(xenzeo) gid=513(none) groups=513(none),545(users)
> > $ su -c 'rm -f /home/xenzeo/file'
> > $ ls -l /home/xenzeo/file
> > ls: file: No such file or directory
> > 
> > #!/usr/bin/perl
> > if ($#ARGV != 0) {
> > 	die "usage: rm-exploit.pl file\r\n";
> > } else {
> >     $file = $ARGV[0];
> >     print "*** CMD: [ /bin/rm -f $file ]\r\n";
> >     print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
> >     if ($> == 0) {
> >        print "[-] EXECUTING CMD\r\n";
> >        system("/bin/rm -f $file");
> >        print "[-] DONE\r\n";
> >        print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
> >        exit();
> >     } else {
> >        print "[-] EXPLOIT FAILED\r\n";
> >        print "[-] YOU ARE NOT ROOT\r\n";
> >        print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
> >     }
> > }
> > 
> > Vender status:
> >          Neither FreeBSD nor Linux developers have been contacted
> >          yet!
> > 
> > -Xenzeo
> > 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041230/09af09e5/attachment.bin