full-disclosure - Symlink attack techniques

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200512142242.19003.werner_schalk@gmx.de>
Date: Thu Dec 15 02:57:45 2005
From: werner_schalk at gmx.de (Werner Schalk)
Subject: Symlink attack techniques

Hi,

I am currently doing a pentest and I was wondering whether you guys would know 
any symlink attack technique for the following scenario:

On a Unix system there is a cronjob set up which will use the find command to 
create some sort of report and output that report to a predictable file 
in /tmp. So basically the command in the crontab is something like:

15 4  * * 6     root    /usr/bin/find [command] > /tmp/report.txt

Due to the fact that I can't influence what is written to that file but 
link /tmp/report to a different file (e.g. /etc/passwd) I can cause some 
local disruption/problems I think. So my question now is: Is there any other 
way of executing code in this scenario? Can I use file descriptors with this?

Any input is greatly appreciated. Thank you. 

All the best,
Werner.