A post for UNIX/LINUX experts...

[xposed]

env TERM='`cp /bin/sh /tmp/sh;chown root /tmp/sh;chmod 4755/tmp/sh`' change-pass




What in the world does this command mean? it would be great if someone could break down each little thing like for example the '` part for example, just decrypt the whole line to lamens terms please, thanks !

-xposed

[linuxcomando]

your enviormental variable TERM is now set to first cp /bin/sh then chownership so that root -owns /tmp/sh and then runs change-pass as the user root,
Looks like something copied from an exploit

[xposed]

how does that gain you root access?

[Terr]

I only tinker in *nix, but it looks like that is described here.

I think the basic idea is that the TERM variable is set to a string of commands which are then executed when the script is run. Because the script has SUID status, the script has the permissions of the script owner, not the script user, therefore the attacker runs those commands as root...

[smirc]

Yep, it's code from an exploit. This is usually a method that crackers resort to when the buffer they are trying to overflow isn't big enough to hole the code that they want to execute. Instead of passing the code to the buffer you run the code straight from an environment variable. The catch is that, for this to work, you need to have an account on the box before you can try this so you can read/set environment variables. So basically it's used to elevate privilidges.

[antioperator]

hi ...some body can helpme ? i wann learn about take over channel and i wann try with my chennl.thanks

[Terr]

Originally posted here by antioperator
hi ...some body can helpme ? i wann learn about take over channel and i wann try with my chennl.thanks

Idiot Alert.

[l3aDmOnKeY]

The thing that throws me there is the "chmod 4755" chmod lets you change ownership of files it should be something like this right? chmod 777 777 777 which is total ownership.

[cgkanchi]

No, the chmod command uses octal notation (when used with numbers). So chmod 777 is full access, chmod 700 is full access to owner and no access to group and others and so on. The first digit is for owner, the second for group and the third for others. Hope that clears things up.
Cheers,
cgkanchi

[l3aDmOnKeY]

O ya thats right <badmonkey slaps the **** out of himself> now I remember.

Thanks cgkanchi!