Incidents
Suspicious files in /tmp Jun 16 2007 06:13PM
kladizkov.thehome (kladizkov thehome gmail com) (3 replies)
Re: Suspicious files in /tmp Jun 18 2007 05:12PM
Jamie Riden (jamie riden gmail com)
Re: Suspicious files in /tmp Jun 18 2007 05:08PM
Jamie Riden (jamie riden gmail com)
Re: Suspicious files in /tmp Jun 18 2007 04:47PM
Matt D. Harris (mdh solitox net) (5 replies)
Re: Suspicious files in /tmp Jun 21 2007 11:38AM
Remko Lodder (remko elvandar org) (1 replies)
Re: Suspicious files in /tmp Jun 21 2007 08:05PM
Cy Schubert (Cy Schubert komquats com)
Re: Suspicious files in /tmp Jun 19 2007 01:33AM
Robin Sheat (robin kallisti net nz) (1 replies)
Re: Suspicious files in /tmp Jun 20 2007 04:47PM
Valdis Kletnieks vt edu (1 replies)
RE: Suspicious files in /tmp Jun 20 2007 11:06PM
Thyago Braga da Silva (tbraga gasecurity com br) (1 replies)
RE: Suspicious files in /tmp Jun 21 2007 05:09PM
kaneda bohater net (1 replies)
On Wed, 20 Jun 2007, Thyago Braga da Silva wrote:

:] A binary which you have NOT permission to execute but only to read, it can
:] be executed.

Morning...

On 2.6 kernel its not possible JUST run directly from noexec partition:

[@ogoreczek ~]$ /lib/ld-linux.so.2 /tmp/ls
/tmp/ls: error while loading shared libraries: /tmp/ls: failed to map
segment from shared object: Operation not permitted

/dev/hda2 on /tmp type ext3 (rw,noexec)

but of course You can still use other interpreter:

[@ogoreczek /tmp]$ /usr/bin/perl /tmp/a.pl
lpr

[@ogoreczek /tmp]$ /lib/ld-linux.so.2 /usr/bin/perl /tmp/a.pl
lpr

[@ogoreczek /tmp]$ cat a.pl
#!/usr/bin/perl
print "lpr\n";

Kanedaaa

:]
:] On Tue, 19 Jun 2007 13:33:21 +1200, Robin Sheat said:
:] > I think it's also the case (I don't have a noexec partition handy to
:] > test on) that you can get around this by doing something like:
:] > /lib/ld-linux.so.2 /tmp/mybadbinary
:] > e.g.:
:] > /lib/ld-linux.so.2 /bin/ls
:]
:] This particular trick was closed in the 2.6.0 kernel. I am *not* sure
:] whether the fix was backported to the 2.4 kernel or not.
:]

--
[][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]
..
[+] You can take our lives,but you will never take our Freedom - W.Wallace
[+] Peace on earth depends on the peace in the peoples hearts - Dalai Lama
[+] Revolution the only solution - System of a down...
[+] Dalej idac dalej dojdziesz dalej siedzac dalej siedzisz - etoe aka ok0
[-] Kanedaaa... Bohateur... Cucumber Team Member... kaneda (at) bohater (dot) net [email concealed]

------------------------------------------------------------------------
-
This list sponsored by: SPI Dynamics

ALERT: .How a Hacker Launches a SQL Injection Attack!.- White Paper
It's as simple as placing additional SQL commands into a Web Form input box
giving hackers complete access to all your backend systems! Firewalls and IDS
will not stop such attacks because SQL Injections are NOT seen as intruders.
Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000Cn8
E
------------------------------------------------------------------------
--

[ reply ]
Re: Suspicious files in /tmp Jun 22 2007 12:19AM
Eduardo Tongson (propolice gmail com)
Re: Suspicious files in /tmp Jun 19 2007 12:23AM
Rainer Duffner (rainer ultra-secure de)
Re: Suspicious files in /tmp Jun 19 2007 12:17AM
Rainer Duffner (rainer ultra-secure de)
Re: Suspicious files in /tmp Jun 18 2007 09:32PM
Michal Zalewski (lcamtuf dione ids pl) (1 replies)
Re: Suspicious files in /tmp Jun 19 2007 12:37AM
Matt D. Harris (mdh solitox net)


 

Privacy Statement
Copyright 2010, SecurityFocus