Full Disclosure mailing list archives
Re: /etc/passwd corruption
From: "Benji" <me () b3nji com>
Date: Tue, 25 Jan 2011 20:36:47 +0000
Just setup a temporary account with no password so shadow won't get referenced, save yourself effort ------Original Message------ From: John Jacobs Sender: full-disclosure-bounces () lists grok org uk To: me () halfdog net To: full-disclosure () lists grok org uk Subject: Re: [Full-disclosure] /etc/passwd corruption Sent: Jan 25, 2011 20:21 Hi,
On ubuntu lucid, I found a way to add corrupted entries to /etc/passwd e.g. "AAA\n", but not to /etc/shadow. Does someone know a way to use that for privilege escalation? What is the "+" line handling in /etc/passwd for?
Please see "man 5 passwd", I suspect you'll be able to leverage this to create a system account in /etc/passwd. The file will likely need to contain a crypt()'d password. Not exactly sure how PAM will handle. The Ubuntu gents are normally really good about fixing security issues so you'll likely want to get in touch with them so they can fix it up. Cheers, John _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ Sent from my BlackBerry® wireless device _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- /etc/passwd corruption halfdog (Jan 25)
- Re: /etc/passwd corruption John Jacobs (Jan 25)
- <Possible follow-ups>
- Re: /etc/passwd corruption Benji (Jan 25)