full-disclosure - Re: SSH brute force blocking tool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20061127214031.GB10259@uriel.eclipsed.net>
Date: Mon, 27 Nov 2006 16:40:31 -0500
From: gabriel rosenkoetter <gr@...ipsed.net>
To: "J. Oquendo" <sil@...iltrated.net>
Cc: Tavis Ormandy <taviso@...too.org>,
	full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: SSH brute force blocking tool

On Mon, Nov 27, 2006 at 04:27:24PM -0500, J. Oquendo wrote:
> So for the third time now. Explain to me how I am backdooring someone's 
> system.
> 
> [root@...alhost include]# uname -a
> Linux int-mrkt 2.6.18-1.2200.fc5 #1 Sat Oct 14 16:59:26 EDT 2006 i686 
> i686 i386 GNU/Linux
> [root@...alhost include]# awk '/error retrieving/{getline;print $13}' 
> /var/log/secure|sort -ru
> 222.171.20.252
> 211.137.74.58
> 
> My logs parse out addresses not named and there is no redirection going 
> on. If you want to say "Hey... It should be written as such" then gladly 
> do so.

You are dealing with output you can't trust there. $13 could be
anything, including "\n`rm -rf /`". Later on, you pass $13,
unstripped of newlines, backticks, or any number of other special
character to a shell running as uid 0. That shell will proceed to
execute whatever we would like it to, where "we" are "the remote
attacker who doesn't even have an account".

I don't believe the suggestion was ever that you had malicious
intent, but rather that you have very horrible coding security
habits.

I'm disinclined to sort out which of your machines I can get root on
right now because you are running this script, but I would expect
that someone reading this mailing list is already on the way and
would strongly advise that you disable those cron jobs.

-- 
gabriel rosenkoetter
gr@...ipsed.net

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/