I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information yet on how to know if your vulnerable or not except by running the exploit. Which I did and ended up getting a heap of trouble from the data center for doing so. With this being the case, what is the best way to check to see if your vulnerable? Can one assume that there will be a fix released for the vulnerability before they get hacked using the exploit (even with a hardened server)?
|show 1 more comment|
I would consider 2 possible approaches - I note that you are trying to verify an exploit for escalation of privilege exploiting a bug in the kernel. For the sake of the experiment, I would ignore user space software even though this is probably a bad idea.
Approach #1 assuming that you may need access to data on the server in question, I would install a VM with the exact version of the Linux distro and kernel in question and try out your exploit. The VM will effectively sandbox the server from the real host and if you do succeed in crashing the VM - no harm done.
Approach #2 assuming that there are no data dependencies - I would install a VM with the same distro and kernel on any other Linux box you might have in the shop and try out your exploit.
If this is an important machine and your organization has assets worth attacking I would not make any assumptions regarding patches becoming available and being applied before you were attacked.
OTOH - if the machine is not mission critical and the general state of the server farm security countermeasures is good (machines patched regularly, firewalls maintained properly) - I would reduce your level of concern and take the time in the lab
Find what the exploit takes advantage of. Is it your Linux kernel (version)? Then all systems with that version number may be effected.
Assuming you have a vulnerability, you should know what it attacks. If for some reason you don't know what the exploit does don't test it on production servers. If the exploit is a script, then you can just peak and see what it does. If the exploit is compiled into machine code, you will have to try and reverse engineer it to understand what it does or hire someone who can.
You can't assume there will be a fix before someone gets ahold of the exploit, unless the only person that has it is the developer. Developers will only be able to fix them if they know about it. They can learn about new exploits in their software if it is released to the public, sold to them, or found by them.