oss-sec mailing list archives
Re: Re: Terminal escape sequences - the new XSS for admins?
From: Steve Grubb <sgrubb () redhat com>
Date: Tue, 11 Aug 2015 17:59:17 -0400
On Tuesday, August 11, 2015 02:40:12 PM Andy Lutomirski wrote:
At this point, I was convinced that most major emulators are safe. That said...there are all the ones I didn't check including older ones. The older ones are likely to be the ones I'd be most concerned about.Are all the supposedly invulnerable terminals actually safe? Gnome-terminal reports: 0000000: 1b5d 6c54 6572 6d69 6e61 6c1b 5c .]lTerminal.\ That's not as bad as echoing 'ls -al' back to the terminal input, but why is it considered acceptable for terminals to input anything whatsoever in response to the in-band data they receive?
The whole idea is to write something that you can bounce back to the prompt. lTerminal is pretty limiting. An attacker would have to also place the file lTerminal in the search path before using this trick. But if they can do pre- place a file in the search path, they can also take advantage of typing mistakes like placing a file vo and then waiting for the admin to make a mistake typing vi. What you really want to do in an attack is to try placing a call back shell command on the prompt or download/upload files. Most terminal emulators, konsole for example, reply with nothing. Its the vte based ones that reply like this. -Steve
Current thread:
- Terminal escape sequences - the new XSS for admins? Kurt Seifried (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Daniel Kahn Gillmor (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Steve Grubb (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Stephane Chazelas (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Florian Weimer (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Andy Lutomirski (Aug 11)
- Re: Re: Terminal escape sequences - the new XSS for admins? Steve Grubb (Aug 11)
- Re: Re: Terminal escape sequences - the new XSS for admins? Robert Święcki (Aug 12)
- Re: Re: Terminal escape sequences - the new XSS for admins? Dave Horsfall (Aug 12)
- Re: Terminal escape sequences - the new XSS for admins? Steve Grubb (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Daniel Kahn Gillmor (Aug 11)
- Re: Terminal escape sequences - the new XSS for admins? Solar Designer (Aug 17)
- Re: Terminal escape sequences - the new XSS for admins? Michal Zalewski (Aug 31)
- Re: Terminal escape sequences - the new XSS for admins? Michal Zalewski (Aug 31)