If we have access to another user ~/ why installing root kit and not use
some trivial attack ? like path attack as example or clean exec ?
installing a root kit on monitored system will yell alarms. as i
previously said if we have access to another user ~/ we have full access
to all privileges that this user have.
the main issue here is how we get access to the user ~/
about the local virus ..
in the example given by the author we compromise the user A which have
sudo to root
if we have knowledge of the target system we can easily make automated
program that compromises other users accounts but .. /there is always
but/ in order to compromise other users we will need bigger privs than
the user that we attack or some system wide exploit /which is sort of
bigger privs/. then if we have those privs why bothering writing a
automated program and not compromise them at once ?
the only scenario that this is useful is if we have a user A which can
execute commands in the context of a user B which can execute commands
in context of root
in that case if we have a way to compromise user A's ~/ then we can make
some automated program that gathers information ,even have some
predefined logic about handling some commands enabled in /etc/sudoers,
and then exploit it. but thats a very rare case.
p.s.
sudo to root without pass ... c'mon you have to be kidding me, right ?
Javor Ninov aka DrFrancky
drfrancky[shift + 2]securax.org
securitydot.net
Steven M. Christey wrote:
So, in other words, all you need in order to get root access is a
rootkit, your shell script, and root access? Ummm... I don't get it.
I was also confused by this. However, one guess is that by
compromising an unprivileged account and creating command aliases to
run trojaned su and sudo programs, the attacker can hopefully gain
access to another account, then another, etc. By using these sudo
"privilege chains" the attacker might eventually obtain root access.
This attack would be slightly virus-like in behavior, although local
to the system. And it might accomplish less, and more slowly, than if
the attacker used some other means to determine the explicit su/sudo
relationships and exploit them directly (e.g. sudo -l to list allowed
commands?) And this attack sounds like it's entirely dependent on
whether or not such a chain even exists on the system. Insert
standard text about the likelihood of easier attack vectors here.
Just a guess, though. Interesting notion of a local-only "virus" to
compromise users on a multi-user system, although it seems like just
another way to exploit trust relationships once you've gained access
to a local account.
- Steve
signature.asc
Description: OpenPGP digital signature
