Yeah, completely forgot about those ran as root and setuid programs.
Been a while since I have seen those. Also forgot about the usual
admin errors. But it is ridiculous to say "all bets are off" when a
user gets a shell. Thats got a lot to say about the admin in charge.
Ed <http://blog.eonsec.com>
On Jan 30, 2008 2:59 AM, <Valdis.Kletnieks (at) vt (dot) edu [email concealed]> wrote:
> On Tue, 29 Jan 2008 07:57:39 +0800, Eduardo Tongson said:
> > kernel used is fully updated and root SSH login dismissed do you know
> > a way of getting root without an unknown kernel bug?
>
> The *vast* majority of "get r00t kwik" exploits do *not* involve exploiting
> kernel bugs, but involve exploiting daemon processes running as root or
> set-UID programs. So if you have CUPS running, they don't need a kernel
> exploit, they just need a CUPS exploit (and CUPS *has* had a few issues).
> Same for Sendmail, NTP, the X server, or any of the other things found on
> the average Unix/Linux install....
>
Been a while since I have seen those. Also forgot about the usual
admin errors. But it is ridiculous to say "all bets are off" when a
user gets a shell. Thats got a lot to say about the admin in charge.
Ed <http://blog.eonsec.com>
On Jan 30, 2008 2:59 AM, <Valdis.Kletnieks (at) vt (dot) edu [email concealed]> wrote:
> On Tue, 29 Jan 2008 07:57:39 +0800, Eduardo Tongson said:
> > kernel used is fully updated and root SSH login dismissed do you know
> > a way of getting root without an unknown kernel bug?
>
> The *vast* majority of "get r00t kwik" exploits do *not* involve exploiting
> kernel bugs, but involve exploiting daemon processes running as root or
> set-UID programs. So if you have CUPS running, they don't need a kernel
> exploit, they just need a CUPS exploit (and CUPS *has* had a few issues).
> Same for Sendmail, NTP, the X server, or any of the other things found on
> the average Unix/Linux install....
>
[ reply ]