Bugtraq mailing list archives
Re: Sudo tricks
From: "Steven M. Christey" <coley () mitre org>
Date: Sun, 26 Mar 2006 19:26:36 -0500 (EST)
So, in other words, all you need in order to get root access is a rootkit, your shell script, and root access? Ummm... I don't get it.
I was also confused by this. However, one guess is that by compromising an unprivileged account and creating command aliases to run trojaned su and sudo programs, the attacker can hopefully gain access to another account, then another, etc. By using these sudo "privilege chains" the attacker might eventually obtain root access. This attack would be slightly virus-like in behavior, although local to the system. And it might accomplish less, and more slowly, than if the attacker used some other means to determine the explicit su/sudo relationships and exploit them directly (e.g. sudo -l to list allowed commands?) And this attack sounds like it's entirely dependent on whether or not such a chain even exists on the system. Insert standard text about the likelihood of easier attack vectors here. Just a guess, though. Interesting notion of a local-only "virus" to compromise users on a multi-user system, although it seems like just another way to exploit trust relationships once you've gained access to a local account. - Steve
Current thread:
- Sudo tricks John Richard Moser (Mar 23)
- Re: Sudo tricks Dave Korn (Mar 25)
- Re: Sudo tricks Kyle Wheeler (Mar 27)
- Re: Sudo tricks Thomas M. Payerle (Mar 28)
- Re: Sudo tricks Krzysztof Halasa (Mar 29)
- RE: Sudo tricks Burton Strauss (Mar 31)
- <Possible follow-ups>
- Re: Sudo tricks Steven M. Christey (Mar 28)
- Re: Sudo tricks Javor Ninov (Mar 31)
- Re: Sudo tricks Dave Korn (Mar 25)