Re: how an hacker can bypass a chrooted environement ?

[Tonnerre Lombard <tonnerre.lombard () sygroup ch>]

Salut,

On Fri, 2006-05-12 at 11:37, Norbert Fran?ois wrote:
> I was wondering how an attacker can bypass a chrooted environement. A
> (common) technique consist in finding a vulnerable program (in the
> chrooted environnement) and injecting it a shellcode (i.e
> ../../../../../../../bin/bash for ex.)  by BoF.  But normally, in the
> chrooted environement, you volontarily add only necessary tools (like
> ls, cat, less...), and vulnerable softwares are uncommon...
>
> So... how do they this "exploit" of bypassing the chroot ?

For example by getting a dir file descriptor from "outside" and
fchrooting to that one.

                                Tonnerre
-- 
SyGroup GmbH
Tonnerre Lombard

Loesungen mit System
Tel:+41 61 333 80 33    Roeschenzerstrasse 9
Fax:+41 61 383 14 67    4153 Reinach
Web:www.sygroup.ch      tonnerre.lombard () sygroup ch

Attachment: signature.asc
Description: This is a digitally signed message part