🚀 go-pugleaf

In article <8exLmiW00WB6QXP4Yb@andrew.cmu.edu> tm8t+@andrew.cmu.edu (Tod McQuillin) writes:

   Found this on one of our systems.  Anyone know if there is any way
   this could be used to obtain root access?

   -rwsr-xr-x  1 root            0 Apr  7  1992 file


Yes, most of the holes that work for setuid-shell scripts will work
for this file, even though it is empty.

		Jim

jim@cs.strath.ac.uk (Jim Reid) writes:

| In article <8exLmiW00WB6QXP4Yb@andrew.cmu.edu> tm8t+@andrew.cmu.edu (Tod McQuillin) writes:

|    Found this on one of our systems.  Anyone know if there is any way
|    this could be used to obtain root access?
|    -rwsr-xr-x  1 root            0 Apr  7  1992 file

| Yes, most of the holes that work for setuid-shell scripts will work
| for this file, even though it is empty.

I seriously doubt it.  The kernel hasn't the faintest idea what to do
to execute a file like this.  Try running an empty file with a shell
that does not default to /bin/sh or similar and you will get an "exec
format error".  setuid shell-script holes require the #!  "feature",
and they require it in the kernel, which is the only entity capable of
granting setuid access when executing a program.

-- 
robert earl          |
rearl@ucsd.edu       | "I got a bottle of tequila, baby, who needs friends?"
rearl@piggy.ucsb.edu |   --Johnette Napolitano, Concrete Blonde

In article <8exLmiW00WB6QXP4Yb@andrew.cmu.edu> tm8t+@andrew.cmu.edu (Tod McQuillin) writes:
>Found this on one of our systems.  Anyone know if there is any way
>this could be used to obtain root access?
>
>-rwsr-xr-x  1 root            0 Apr  7  1992 file
>
>Note the file has zero length.

Possibly if you system supports set-uid shell scripts in a warped
manner it might.  You would have to find out if the shell that is
(presumably ...) started to execute that script runs set-uid.  Then
see if the usual suite of set-uid shell script holes can be used
with that file.
-- 
John F. Haugh II                  [  TSAKC  ] !'s: ...!cs.utexas.edu!rpp386!jfh
Ma Bell: (512) 251-2151           [ DoF #17 ]        @'s: jfh@rpp386.cactus.org

In article <21806@rpp386.lonestar.org>, jfh@rpp386.lonestar.org (John F. Haugh II) writes:
> In article <8exLmiW00WB6QXP4Yb@andrew.cmu.edu> tm8t+@andrew.cmu.edu (Tod McQuillin) writes:
> >Found this on one of our systems.  Anyone know if there is any way
> >this could be used to obtain root access?
> >
> >-rwsr-xr-x  1 root            0 Apr  7  1992 file
> >
> >Note the file has zero length.
> 
> Possibly if you system supports set-uid shell scripts in a warped
> manner it might.  You would have to find out if the shell that is
> (presumably ...) started to execute that script runs set-uid.  Then
> see if the usual suite of set-uid shell script holes can be used
> with that file.

I've never heard of shells themselves running setuid, and I hope I never
do...  Ksh uses a setuid root intermediate program to implement setuid
shell scripts on systems where the kernel doesn't do it.  It uses
open file descriptors, rather than names, and so should be immune
to the usual hack.

So -- I don't know of any problems with that file.  But I confess that
it makes me extremely nervous -- I just have a very bad feeling about it...

In article <1992Nov3.211052.11569@ulysses.att.com> smb@ulysses.att.com (Steven Bellovin) writes:
>I've never heard of shells themselves running setuid, and I hope I never
>do...  Ksh uses a setuid root intermediate program to implement setuid
>shell scripts on systems where the kernel doesn't do it.  It uses
>open file descriptors, rather than names, and so should be immune
>to the usual hack.

No, I was referring to if the system starts the shell with an effective
UID of the script file owner - NOT that the shell itself was set-UID.

I also doubt that the zero length script would pose a problem since the
kernel looks for "#!" as a magic number before deciding it is a shell
script.  That's why the comment about being implemented in a "warped"
manner was put in there.

>So -- I don't know of any problems with that file.  But I confess that
>it makes me extremely nervous -- I just have a very bad feeling about it...

I don't either, but the way to find out is to see if the exec() of the
file returns an ENOEXEC error, or if the system runs off and executes
it anyway.  My bet is that the system returns ENOEXEC ...
-- 
John F. Haugh II                  [  TSAKC  ] !'s: ...!cs.utexas.edu!rpp386!jfh
Ma Bell: (512) 251-2151           [ DoF #17 ]        @'s: jfh@rpp386.cactus.org

In article <1992Nov3.211052.11569@ulysses.att.com> smb@ulysses.att.com (Steven Bellovin) writes:
>I've never heard of shells themselves running setuid, and I hope I never
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

>do...  Ksh uses a setuid root intermediate program to implement setuid
>shell scripts on systems where the kernel doesn't do it.  It uses
>open file descriptors, rather than names, and so should be immune
>to the usual hack.
>
>So -- I don't know of any problems with that file.  But I confess that
>it makes me extremely nervous -- I just have a very bad feeling about it...


really? Never?


-- 
Ryan A. Whelan                      "Repetition does not establish validity."
rwhelan@gmuvax2.gmu.edu                                         - Souder's Law