About this list Date view Thread view Subject view Author view Attachment view

From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Mon 09 Feb 2004 - 12:46:13 GMT


On Mon, Feb 09, 2004 at 01:36:25PM +0100, Kern Wolfgang wrote:
> Hello Herbert,
>
> I have all steps you write executed:
>
> chmod 000 /vservers
> chattr +t /vservers
>
> with a reset of chmod and all other commands. Still this one...
>
> pbvsc:~# lsattr -d /vservers
> -------------t /vservers
>
> pbvsc:~# ls -ld /vservers
> d--------- 8 root sys 4096 Feb 2 12:36 /vservers

well, you probably can change the group of that dir to
group root with 'chgrp root /vservers' if that is what
you mean, but that doesn't make it less secure ...

exploit should not work, if it does, something is wrong
with your kernel ...

Linux (none) 2.4.24-vs1.26 #1 SMP Fri Feb 6 21:42:12 CET 2004 i686 unknown

HTH,
Herbert

> Regards
>
> Development Department Germany
>
> W)ireless W)inds GbR.
> Hosting | CoLocation | IP-Transit
> Design | Develop. | Production
>
> | Web: http://www.Wireless-Winds.de
> | Web: http://www.WWip.de
> | Web: http://www.WWip.ch
> | eMail: vserver_at_WWip.de
>
>
> CONFIDENTIALITY NOTICE
> This mail contains information which is confidential and may also be
> privileged. It is for exclusive use of the intended recipient(s). If you are
> not the intended recipient(s), please note that any distribution, copying
> or use of this mail or the information in it is strictly prohibited. If you
> have received this mail in error, please notify us immediately and then
> destroy this mail and any copies of it. Thank you!
>
> HINWEIS
> Diese Nachricht enthält vertrauliche Informationen. Diese sind ausdrücklich
> nur für den/die Empfänger dieser Nachricht bestimmt. Sollten Sie nicht der
> beabsichtigte Empfänger sein so nehmen Sie bitte zur Kenntnis, dass jede
> Weiterleitung, jede Kopie oder die Verwendung der in dieser Nachricht
> enthaltenen Informationen untersagt ist. Sollten Sie diese Nachricht
> fälschlicherweise erhalten haben, so benachrichtigen Sie uns bitte umgehend
> und löschen Sie diese Nachricht und sämtliche Kopien bzw. Ausdrucke. Vielen
> Dank!
>
>
>
> -----Ursprüngliche Nachricht-----
> Von: Herbert Poetzl [mailto:herbert_at_13thfloor.at]
> Gesendet: Montag, 9. Februar 2004 13:29
> An: Kern Wolfgang
> Cc: vserver_at_list.linux-vserver.org; 'Sven Hummelsberger '; Svenlito_at_web.de;
> ben_at_traffic4all.com
> Betreff: Re: [Vserver] Analyze root-exploit with 1.26 and util 0.28
>
> On Mon, Feb 09, 2004 at 01:15:52PM +0100, Kern Wolfgang wrote:
> > Hi vServer Team,
> >
> > i have downloaded and compiled this expl. too and with 1.26 (Kernel
> 2.4.24)
> > the expl. seems still to work :(
> >
> > i have try this both ways:
> >
> > chmod 000 /vservers
> > chattr +t /vservers
> >
> > and with
> >
> > chmod +t /vservers
> >
> > but this expl. Is still working, the only different between chattr and
> chmod
> > is one little line of error like this:
>
> *sigh*
>
> chmod 000 /vservers
> chmod +t /vservers
>
> / # ls -ld /vservers
> d--------T 10 root root 1024 Dec 6 00:15 /vservers
> / # lsattr -d /vservers
> ------------- /vservers
>
> INSECURE!!
>
>
> chmod 000 /vservers
> chattr +t /vservers
> chmod +t /vservers
>
> / # ls -ld /vservers
> d--------T 10 root root 1024 Dec 6 00:15 /vservers
> / # lsattr -d /vservers
> -----------t- /vservers
>
> INSECURE!!
>
>
> chmod 000 /vservers
> chattr +t /vservers
>
> / # ls -ld /vservers
> d--------- 10 root root 1024 Dec 6 00:15 /vservers
> / # lsattr -d /vservers
> -----------t- /vservers
>
> SECURE
>
> what are your flags today?
>
> HTH,
> Herbert
>
> > root_at_VM1:~# ./chroot_exp
> > cd ..: Permission denied
> > Exploit seems to work. =)
> >
> > But for now i can see full host strukture... the very bad thing is, i can
> > modify and delete any file from the host, seems like full root rights. The
> > mystic way, i have to "exit" two times for a normaly host view, like this:
> >
> > root_at_VM1:/# exit
> > exit
> > root_at_VM1:~# exit
> > logout
> > pbvsc:~#
> >
> > At first "exit" the system is in the last folder from i started the expl.
> > With the second "exit" the system is right now in host system. With SSH on
> > the expl. V-child i have no access to host system if i try this over ssh
> on
> > a v-child it works like vserver NAME enter. One thing i don't understand
> for
> > right now... after execute the exploit the right are set to:
> >
> > Owner: root
> > Group: root
> >
> > If i set all back with chattr and chmod the rights set to:
> >
> > Owner: root
> > Group: sys
> >
> > I hope, i have not repeated this problem the 1000000x...
> >
> >
> >
> >
> >
> > Regards
> >
> > Development Department Germany
> >
> > W)ireless W)inds GbR.
> > Hosting | CoLocation | IP-Transit
> > Design | Develop. | Production
> >
> > | Web: http://www.Wireless-Winds.de
> > | Web: http://www.WWip.de
> > | Web: http://www.WWip.ch
> > | eMail: vserver_at_WWip.de
> >
> >
> > CONFIDENTIALITY NOTICE
> > This mail contains information which is confidential and may also be
> > privileged. It is for exclusive use of the intended recipient(s). If you
> are
> > not the intended recipient(s), please note that any distribution, copying
> > or use of this mail or the information in it is strictly prohibited. If
> you
> > have received this mail in error, please notify us immediately and then
> > destroy this mail and any copies of it. Thank you!
> >
> > HINWEIS
> > Diese Nachricht enthält vertrauliche Informationen. Diese sind
> ausdrücklich
> > nur für den/die Empfänger dieser Nachricht bestimmt. Sollten Sie nicht der
> > beabsichtigte Empfänger sein so nehmen Sie bitte zur Kenntnis, dass jede
> > Weiterleitung, jede Kopie oder die Verwendung der in dieser Nachricht
> > enthaltenen Informationen untersagt ist. Sollten Sie diese Nachricht
> > fälschlicherweise erhalten haben, so benachrichtigen Sie uns bitte
> umgehend
> > und löschen Sie diese Nachricht und sämtliche Kopien bzw. Ausdrucke.
> Vielen
> > Dank!
> >
> > _______________________________________________
> > Vserver mailing list
> > Vserver_at_list.linux-vserver.org
> > http://list.linux-vserver.org/mailman/listinfo/vserver
>
> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 09 Feb 2004 - 12:47:38 GMT by hypermail 2.1.3