Full Disclosure mailing list archives
Re: /bin/rm file access vulnerability
From: vh <vh () helith net>
Date: Thu, 30 Dec 2004 05:46:50 +0100
I wont say anything so just enjoy this: $ cd /tmp $ ls hydra-4.4-src sylpheed-1000 hydra-4.4-src.tar.gz xmms_rembrandt.0 $ rm -rf * $ ls $ touch ProofOfDumbness $ ls -la total 20 drwxrwxrwt 4 root wheel 512 Dec 30 05:39 . drwxr-xr-x 15 root wheel 512 Dec 16 11:13 .. drwxrwxrwt 2 root wheel 512 Dec 30 01:21 .ICE-unix -r--r--r-- 1 rembrandt rembrandt 11 Dec 30 02:28 .X0-lock drwxrwxrwt 2 root wheel 512 Dec 30 02:28 .X11-unix -rw-r--r-- 1 rembrandt wheel 0 Dec 30 05:39 ProofOfDumbness $ su Password: # chflags schg ProofOfDumbness # # ls -la total 20 drwxrwxrwt 4 root wheel 512 Dec 30 05:39 . drwxr-xr-x 15 root wheel 512 Dec 16 11:13 .. drwxrwxrwt 2 root wheel 512 Dec 30 01:21 .ICE-unix -r--r--r-- 1 rembrandt rembrandt 11 Dec 30 02:28 .X0-lock drwxrwxrwt 2 root wheel 512 Dec 30 02:28 .X11-unix -rw-r--r-- 1 rembrandt wheel 0 Dec 30 05:39 ProofOfDumbness # rm ProofOfDumbness # override rw-r--r-- rembrandt/wheel for ProofOfDumbness? y rm: ProofOfDumbness: Operation not permitted # id uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty), 5(operator), 20(staff), 31(guest) # chflags noschg ProofOfDumbness chflags: ProofOfDumbness: Operation not permitted # hrhr... :-] Even r00t can't delete all if he don't know what to do. If you've any questions feel free to buy a UNIX Administrator Handbook or start using manpages. vH
Is this a joke? root can delete any file...isn't that the point of being root? the fact that you can do anything with the system, regardless of permissions? -Sean Lennart Hansen wrote:/bin/rm file access vulnerability Affected Products: /bin/rm (all versions, tested on FreeBSD and linux) (http://www.freebsd.org http://www.kernel.org) Author: Xenzeo (Ablazed, Ultralaser, Lennart A. Hansen) xenzeo at blackhat dot dk /bin/rm is a program that removes the named file arguments on unix systems. When /bin/rm is called it checks the file's permissions and the id of the user trying to remove the file. If the user does not have the required permissions to delete the file, /bin/rm will simply reject and exit. However, it is possible for a person with admin rights (root) to delete _any_ file on the system regardless of who has created it and what it's permissions are. Proof of concepts: $ touch /home/xenzeo/file $ ls -l /home/xenzeo/file -rw-r--r-- 1 xenzeo none 0 Dec 30 2004 /home/xenzeo/file $ id uid=1000(xenzeo) gid=513(none) groups=513(none),545(users) $ su -c 'rm -f /home/xenzeo/file' $ ls -l /home/xenzeo/file ls: file: No such file or directory #!/usr/bin/perl if ($#ARGV != 0) { die "usage: rm-exploit.pl file\r\n"; } else { $file = $ARGV[0]; print "*** CMD: [ /bin/rm -f $file ]\r\n"; print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n"; if ($> == 0) { print "[-] EXECUTING CMD\r\n"; system("/bin/rm -f $file"); print "[-] DONE\r\n"; print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n"; exit(); } else { print "[-] EXPLOIT FAILED\r\n"; print "[-] YOU ARE NOT ROOT\r\n"; print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n"; } } Vender status: Neither FreeBSD nor Linux developers have been contacted yet! -Xenzeo_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: /bin/rm file access vulnerability bkfsec (Dec 31)
- Re: /bin/rm file access vulnerability J.A. Terranson (Jan 06)
- Re: /bin/rm file access vulnerability bkfsec (Jan 06)
- <Possible follow-ups>
- Re: /bin/rm file access vulnerability Sean Harlow (Dec 31)
- Re: /bin/rm file access vulnerability vh (Jan 06)
- Re: /bin/rm file access vulnerability Jeffrey Denton (Dec 31)
- Re: /bin/rm file access vulnerability Frank Knobbe (Jan 02)
- Re: /bin/rm file access vulnerability vh (Jan 06)
- Re: /bin/rm file access vulnerability J.A. Terranson (Jan 06)
- Re: /bin/rm file access vulnerability Jerry (Jan 03)
- Re: /bin/rm file access vulnerability James Longstreet (Jan 01)
- Re: /bin/rm file access vulnerability Valdis . Kletnieks (Jan 04)
- Re: /bin/rm file access vulnerability Alex V. Lukyanenko (Jan 03)