ptrace/kmod local root exploit STILL unresolved in 2.4.21! - MY MISTAKE
I've tested this exploit in wrong way. I've first logged in as root, then I made "su nobody" and then exploit worked.
If I don't login as root at the beginning, I get operation not permited.. so kernel is safe after all :)
Thanks 4 your time
Best regards,
Bojan Pogacar
Quoted 3 lines
Hello,
I've upgraded my linux box to 2.4.21 because of the securety reasons. Now
I
Quoted 10 lines
found out that old local expoloit for ptrace is stil working under 2.4.21. Wasn't it fixed in RC1?
In attachment I send you exploit, which is still working!
Best regards,
Bojan Pogacar
Quoted 2 lines · Bojan Pogaèar
I've tested this exploit in wrong way. I've first logged in as root, then I made "su nobody" and then exploit worked.
Maybe "nobody" isn't a "real" user in your case. If there is some problem with it, you may end up with uid 0 after "su nobody".
check the output of the command "id" after the executiong the su command, just to be safe in any case!
If su really worked correctly, the exploit may not even work if you su (successfully) su'ed from root.
Bernd
Quoted 26 lines
If I don't login as root at the beginning, I get operation not permited.. so kernel is safe after all :)
Thanks 4 your time
Best regards,
Bojan Pogacar
Quoted 3 lines
Hello,
I've upgraded my linux box to 2.4.21 because of the securety reasons. Now
I
Quoted 10 lines
found out that old local expoloit for ptrace is stil working under 2.4.21. Wasn't it fixed in RC1?
In attachment I send you exploit, which is still working!
Best regards,
Bojan Pogacar
Hi all.
Quoted 7 lines
Quoted 6 lines
Quoted 3 lines
I've upgraded my Linux box to 2.4.21 because of the security reasons. Now I found out that old local exploit for ptrace is still working under 2.4.21. Wasn't it fixed in RC1?
I've tested this exploit in wrong way. I've first logged in as root, then I made "su nobody" and then exploit worked.
Quoted 8 lines
Maybe "nobody" isn't a "real" user in your case. If there is some problem with it, you may end up with uid 0 after "su nobody".
check the output of the command "id" after the executing the su command, just to be safe in any case!
If su really worked correctly, the exploit may not even work if you su (successfully) su'ed from root.
Probably more to the point, the command su nobody does NOT log you in as user nobody. You need the command su -l nobody to do that. Check the manpage for su to verify that without the -l option, you are still logged in as user root although you are running with the effective user nobody.
My understanding is that the permissions checks can succeed when EITHER your login or effective user would succeed in most cases, but in some cases, it's when your login user succeeds irrespective of whether your effective user would succeed or not.
Best wishes from Riley.
---
* Nothing as pretty as a smile, nothing as ugly as a frown.
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.488 / Virus Database: 287 - Release Date: 5-Jun-2003