Today I read about anonymous attack to Freedom Hosting II, and I was curious about step 3:

FH2 hacking steps

How is possible to someone using a FTP client to create a symlink to /? Doesn't that require root access?

How could this kind of attack be prevented?

Source: https://motherboard.vice.com/en_us/article/talking-to-the-hacker-who-took-down-a-fifth-of-the-dark-web


No, any user on a *nix system can create a symlink to anywhere else, as long as they have write permissions in the directory where they want to put the symlink. You don't need to be able to view the target; in fact, the target doesn't even need to exist (this is called a broken symlink). However, if you can't view the target file, then you generally won't be able to do anything particularly useful with the symlink.

In this case we're talking about /, and / is generally viewable by all users.

There's not a lot of description in that write-up, but it sounds to me that they used symlinks to bypass a chroot attempt and trick the sftp client into allowing them access outside their home directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.