🚀 go-pugleaf

Robert Earl (chupchup@ferkel.ucsb.edu) wrote:
: 
: |    Found this on one of our systems.  Anyone know if there is any way
: |    this could be used to obtain root access?
: |    -rwsr-xr-x  1 root            0 Apr  7  1992 file
: 
: | Yes, most of the holes that work for setuid-shell scripts will work
: | for this file, even though it is empty.
: 
: I seriously doubt it.  The kernel hasn't the faintest idea what to do
: to execute a file like this.  Try running an empty file with a shell
: that does not default to /bin/sh or similar and you will get an "exec
: format error".  setuid shell-script holes require the #!  "feature",
: and they require it in the kernel, which is the only entity capable of
: granting setuid access when executing a program.

No one yet asked what OS this was, HP-UX doesnt clear the setuid-bit on
an append (at least It didnt in one of its installed versions ive seen),
so appending a shell script to make a setuid shell is a trivial job.

Correct me if im wrong.

Matthew.
--
M.Gream@uts.EDU.AU - Matthew Gream