The most typical is to create a directory, open a file handle and then
chroot into that directory, then chdir'ing to the other directory,
then ../../ up until root and then calling chroot again. Then suppose
you can mount /proc, then you can cd to /proc/1/cwd. Or perhaps,
depending on the vulnerable service using already existing file
descriptors to fchdir() to freedom, what about mknod? shared memory?
unix sockets? signals? kernel exploits? et cetera.
I hope you are starting to get the point that chroot is a severly
flawed concept. Yes many people try to limit what exists inside a
jail, but that doesn't prevent me from uploading my own code through
one method or another.
On 5/12/06, alan <alan@clueserver.org> wrote:
On Fri, 12 May 2006, Norbert François wrote:
> Hi...
>
> I was wondering how an attacker can bypass a chrooted environement. A
> (common) technique consist in finding a vulnerable program (in the
> chrooted environnement) and injecting it a shellcode (i.e
> ../../../../../../../bin/bash for ex.) by BoF. But normally, in the
> chrooted environement, you volontarily add only necessary tools (like
> ls, cat, less...), and vulnerable softwares are uncommon...
>
> So... how do they this "exploit" of bypassing the chroot ?
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com for details.
------------------------------------------------------------------------------
