Penetration Testing mailing list archives
Re: Mac symlink attack techniques?
From: Marco Ivaldi <raptor () mediaservice net>
Date: Mon, 14 Apr 2008 10:59:05 +0200 (ora solare Europa occidentale)
Jon, On Fri, 11 Apr 2008, Jon Hart wrote:
Greetings, I'm curious if anyone has some input on this. I am in a situation where I am able to perform a symlink attack against a process that runs as root on a Mac. The catch is that I can create files that don't exist and get them be created mode 666 for world writable goodness, but if the symlink points to a file that already exists all I can do is clobber its content with garbage. Clearly, havoc can be made by trashing important files, but I'm looking for an elegant and quick method for privilege escalation. Is /etc/ld.so.conf my only option?
Just a few hints off the top of my head. Specific to Mac OS X: http://www.milw0rm.com/exploits/2737 http://www.milw0rm.com/exploits/3386 Other platforms: http://www.0xdeadbeef.info/exploits/raptor_libnspr2 http://www.0xdeadbeef.info/exploits/raptor_libnspr3 http://www.0xdeadbeef.info/exploits/raptor_prctl2.c http://www.milw0rm.com/exploits/792 Hope this helps, -- Marco Ivaldi, OPST Red Team Coordinator Data Security Division @ Mediaservice.net Srl http://mediaservice.net/ ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Mac symlink attack techniques? Jon Hart (Apr 11)
- Re: Mac symlink attack techniques? don bailey (Apr 12)
- Re: Mac symlink attack techniques? Paul Melson (Apr 12)
- Re: Mac symlink attack techniques? Jon Hart (Apr 14)
- Re: Mac symlink attack techniques? Marco Ivaldi (Apr 14)
- Re: Mac symlink attack techniques? Jon Hart (Apr 16)