1

If I change to a potentially compromised user in Unix, for example by using su or sudo -i, then exit with exit, the compromised user could alias exit to something which drops me into a fake shell which has a keylogger. For example, I might:

  1. su to compromised user
  2. exit back to safe user, but it doesn't actually exit
  3. Use sudo to do something as root, but since I'm still in the compromised shell the compromised user could have set up a keylogger
  4. Compromised user has root.

How can I safely leave a shell of a compromised user?

5
  • 4
    Why would you want to change to a compromised account in the first place?
    – Arminius
    Nov 3, 2017 at 18:17
  • ^d works for me, but they could always change the user's default shell to a custom one that handles it differently. Just kill it from another shell instead. Nov 3, 2017 at 18:32
  • 1
    "If I change to a potentially compromised user in Unix": then you are running potentially malicious code and anything can happen. Simply don't do that. Nov 3, 2017 at 19:26
  • You shouldn't need to change to that user, but assuming you somehow did, I would use kill -9 from a higher privilege user. It is not just the exit command that could be malicious.
    – wireghoul
    Nov 4, 2017 at 0:05
  • 1
    @Arminius I mainly meant if there's a chance of it being compromised; say maybe somebody who isn't super trustworthy has access to the account. User accounts are supposed to be secure from each other so I would imagine that nothing bad can happen to your account by simply switching to another one. Nov 4, 2017 at 20:30

1 Answer 1

5

Do not drop to a lesser user using su or sudo from a shell.

While what you propose is a valid risk, there is another, much bigger risk when dropping to a lesser user and then exiting, called the TTY pushback attack, using the TIOCSTI IOCTL. This allows arbitrary data to be sent to the calling shell from the child.

From http://www.halfdog.net/Security/2012/TtyPushbackPrivilegeEscalation/:

When su -s /bin/bash [user] is called from interactive shell, the input queue data pushed back as the target user will be executed by the interactive shell calling su.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.