Printable View
I have been looking for a while now and still can't find a good tutorial on what SUID is and how it can be used against you, I'm reading hacking linux exposed at the moment and can't find anything on the topic, could someone please point me in the right direction?!
-xposed
OK, setuid programs are designed to run with higher privileges than the user who runs the program. The /etc/passwd executable is an example of this. An ordinary user runs this program but this program effectively has to run as root because it needs to make changes to files such as /etc/shadow and /etc/shadow which are only changeable by a superuser (ie. root).Quote:
I have been looking for a while now and still can't find a good tutorial on what SUID is and how it can be used against you, I'm reading hacking linux exposed at the moment and can't find anything on the topic, could someone please point me in the right direction?!
So what happens if a setuid program crashes? Well, if it crashes before it has had a chance to change it privileges back down to the user's there is a risk that the user might be able to exploit this to execute commands with the program's elevated privileges. A common example of this is a buffer overflow attack. The user passes a setiud program some evil code and it crashes the program and usually spawns a remote shell with the higher privalidges of the setuid program. If the program happened to be running as root, guess what? The system has just been owned ;).
http://www.samag.com/documents/s=114...106a/0106a.htm
If that helps.......if not sorry