About this list Date view Thread view Subject view Author view Attachment view

From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Mon 09 Feb 2004 - 12:29:20 GMT


On Mon, Feb 09, 2004 at 01:15:52PM +0100, Kern Wolfgang wrote:
> Hi vServer Team,
>
> i have downloaded and compiled this expl. too and with 1.26 (Kernel 2.4.24)
> the expl. seems still to work :(
>
> i have try this both ways:
>
> chmod 000 /vservers
> chattr +t /vservers
>
> and with
>
> chmod +t /vservers
>
> but this expl. Is still working, the only different between chattr and chmod
> is one little line of error like this:

*sigh*

chmod 000 /vservers
chmod +t /vservers

/ # ls -ld /vservers
d--------T 10 root root 1024 Dec 6 00:15 /vservers
/ # lsattr -d /vservers
------------- /vservers

INSECURE!!

chmod 000 /vservers
chattr +t /vservers
chmod +t /vservers

/ # ls -ld /vservers
d--------T 10 root root 1024 Dec 6 00:15 /vservers
/ # lsattr -d /vservers
-----------t- /vservers

INSECURE!!

chmod 000 /vservers
chattr +t /vservers

/ # ls -ld /vservers
d--------- 10 root root 1024 Dec 6 00:15 /vservers
/ # lsattr -d /vservers
-----------t- /vservers

SECURE

what are your flags today?

HTH,
Herbert

> root_at_VM1:~# ./chroot_exp
> cd ..: Permission denied
> Exploit seems to work. =)
>
> But for now i can see full host strukture... the very bad thing is, i can
> modify and delete any file from the host, seems like full root rights. The
> mystic way, i have to "exit" two times for a normaly host view, like this:
>
> root_at_VM1:/# exit
> exit
> root_at_VM1:~# exit
> logout
> pbvsc:~#
>
> At first "exit" the system is in the last folder from i started the expl.
> With the second "exit" the system is right now in host system. With SSH on
> the expl. V-child i have no access to host system if i try this over ssh on
> a v-child it works like vserver NAME enter. One thing i don't understand for
> right now... after execute the exploit the right are set to:
>
> Owner: root
> Group: root
>
> If i set all back with chattr and chmod the rights set to:
>
> Owner: root
> Group: sys
>
> I hope, i have not repeated this problem the 1000000x...
>
>
>
>
>
> Regards
>
> Development Department Germany
>
> W)ireless W)inds GbR.
> Hosting | CoLocation | IP-Transit
> Design | Develop. | Production
>
> | Web: http://www.Wireless-Winds.de
> | Web: http://www.WWip.de
> | Web: http://www.WWip.ch
> | eMail: vserver_at_WWip.de
>
>
> CONFIDENTIALITY NOTICE
> This mail contains information which is confidential and may also be
> privileged. It is for exclusive use of the intended recipient(s). If you are
> not the intended recipient(s), please note that any distribution, copying
> or use of this mail or the information in it is strictly prohibited. If you
> have received this mail in error, please notify us immediately and then
> destroy this mail and any copies of it. Thank you!
>
> HINWEIS
> Diese Nachricht enthält vertrauliche Informationen. Diese sind ausdrücklich
> nur für den/die Empfänger dieser Nachricht bestimmt. Sollten Sie nicht der
> beabsichtigte Empfänger sein so nehmen Sie bitte zur Kenntnis, dass jede
> Weiterleitung, jede Kopie oder die Verwendung der in dieser Nachricht
> enthaltenen Informationen untersagt ist. Sollten Sie diese Nachricht
> fälschlicherweise erhalten haben, so benachrichtigen Sie uns bitte umgehend
> und löschen Sie diese Nachricht und sämtliche Kopien bzw. Ausdrucke. Vielen
> Dank!
>
> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 09 Feb 2004 - 12:30:47 GMT by hypermail 2.1.3