full-disclosure - Re: /etc/passwd corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 25 Jan 2011 20:36:47 +0000
From: "Benji" <me@...ji.com>
To: "John Jacobs" <flamdugen@...mail.com>,
	full-disclosure-bounces@...ts.grok.org.uk, me@...fdog.net,
	full-disclosure@...ts.grok.org.uk
Subject: Re: /etc/passwd corruption

Just setup a temporary account with no password so shadow won't get referenced, save yourself effort

------Original Message------
From: John Jacobs
Sender: full-disclosure-bounces@...ts.grok.org.uk
To: me@...fdog.net
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] /etc/passwd corruption
Sent: Jan 25, 2011 20:21

Hi,

> On ubuntu lucid, I found a way to add corrupted entries to /etc/passwd
> e.g. "AAA\n", but not to /etc/shadow. Does someone know a way to use
> that for privilege escalation? What is the "+" line handling in
> /etc/passwd for?

Please see "man 5 passwd", I suspect you'll be able to leverage this to 
create a system account in /etc/passwd.  The file will likely need to contain 
a crypt()'d password.  Not exactly sure how PAM will handle.

The Ubuntu gents are normally really good about fixing security issues so
you'll likely want to get in touch with them so they can fix it up.

Cheers,
John

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Sent from my BlackBerry® wireless device
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/