Re: Suspicious files in /tmp

[Robin Sheat <robin () kallisti net nz>]

On Tuesday 19 June 2007 04:47:13 Matt D. Harris wrote:
> They're being executed despite filesystem mount options because the
> script isn't being executed, the perl interpretter is.  The script is
> being read and interpretted by the perl interpretter.
I think it's also the case (I don't have a noexec partition handy to test on) 
that you can get around this by doing something like:
/lib/ld-linux.so.2 /tmp/mybadbinary
e.g.:
/lib/ld-linux.so.2 /bin/ls

noexec is at best an annoyance to an attacker rather than a real security 
measure. Of course, it would be nice to see a check in interpreters just to 
make things that much trickier.

-- 
Robin <robin () kallisti net nz> JabberID: <eythian () jabber kallisti net nz>

Hostes alienigeni me abduxerunt. Qui annus est?

PGP Key 0xA99CEB6D = 5957 6D23 8B16 EFAB FEF8  7175 14D3 6485 A99C EB6D

Attachment: _bin
Description: