Full Disclosure mailing list archives
Re: /bin/rm file access vulnerability
From: "Alex V. Lukyanenko" <y_avenger_y () ua fm>
Date: Thu, 30 Dec 2004 20:47:31 +0200
Nice joke. And the amount and the seriousness of the replies means that lots of us security people need to have a little break, so ... Happy new year everyone. -- Alex V. Lukyanenko | 86195208@icq | y_avenger_y () ua fm LH> /bin/rm file access vulnerability LH> Affected Products: LH> /bin/rm (all versions, tested on FreeBSD and linux) LH> (http://www.freebsd.org http://www.kernel.org) LH> Author: LH> Xenzeo (Ablazed, Ultralaser, Lennart A. Hansen) LH> xenzeo at blackhat dot dk LH> /bin/rm is a program that removes the named file arguments on unix systems. LH> When /bin/rm is called it checks the file's permissions and the id of the user LH> trying to remove the file. If the user does not have the required permissions LH> to delete the file, /bin/rm will simply reject and exit. LH> However, it is possible for a person with admin rights (root) to LH> delete _any_ file LH> on the system regardless of who has created it and what it's permissions are. LH> Proof of concepts: LH> $ touch /home/xenzeo/file LH> $ ls -l /home/xenzeo/file LH> -rw-r--r-- 1 xenzeo none 0 Dec 30 2004 /home/xenzeo/file LH> $ id LH> uid=1000(xenzeo) gid=513(none) groups=513(none),545(users) LH> $ su -c 'rm -f /home/xenzeo/file' LH> $ ls -l /home/xenzeo/file LH> ls: file: No such file or directory LH> #!/usr/bin/perl LH> if ($#ARGV != 0) { LH> die "usage: rm-exploit.pl file\r\n"; LH> } else { LH> $file = $ARGV[0]; LH> print "*** CMD: [ /bin/rm -f $file ]\r\n"; LH> print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n"; LH> if ($> == 0) { LH> print "[-] EXECUTING CMD\r\n"; LH> system("/bin/rm -f $file"); LH> print "[-] DONE\r\n"; LH> print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n"; LH> exit(); LH> } else { LH> print "[-] EXPLOIT FAILED\r\n"; LH> print "[-] YOU ARE NOT ROOT\r\n"; LH> print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n"; LH> } LH> } LH> Vender status: LH> Neither FreeBSD nor Linux developers have been contacted yet! LH> -Xenzeo _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: /bin/rm file access vulnerability bkfsec (Dec 31)
- Re: /bin/rm file access vulnerability J.A. Terranson (Jan 06)
- Re: /bin/rm file access vulnerability bkfsec (Jan 06)
- <Possible follow-ups>
- Re: /bin/rm file access vulnerability Sean Harlow (Dec 31)
- Re: /bin/rm file access vulnerability vh (Jan 06)
- Re: /bin/rm file access vulnerability Jeffrey Denton (Dec 31)
- Re: /bin/rm file access vulnerability Frank Knobbe (Jan 02)
- Re: /bin/rm file access vulnerability vh (Jan 06)
- Re: /bin/rm file access vulnerability J.A. Terranson (Jan 06)
- Re: /bin/rm file access vulnerability Jerry (Jan 03)
- Re: /bin/rm file access vulnerability James Longstreet (Jan 01)
- Re: /bin/rm file access vulnerability Valdis . Kletnieks (Jan 04)
- Re: /bin/rm file access vulnerability Alex V. Lukyanenko (Jan 03)