Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off):

  alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo'
I don't think it matters that he used his root account.

Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476

Edit: Last exploit for Linux remote exploitation with Flash is from 2015 https://www.rapid7.com/db/modules/exploit/multi/browser/adob... or did I miss something here?



As an attacker, I test for sudo -n. If it succeeds, I have root. In most cases I do not need it however. SSH key trusts, SSH multiplexing and bad posix permissions are more than enough to get me anywhere and grab anything.


I'm going to make a separate account just to run the web browser, xhost +localhost && su -c web-browser unprivileged-user


If you're using xwindows they can just install a keylogger


There was a zero-day for Flash being exploited ITW just a few days ago.


I didn't think any browser on Linux still supported Flash.


I use /usr/bin/sudo <>


So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.


> So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

    $ alias /usr/bin/sudo=whatever
    bash: alias: `/usr/bin/sudo': invalid alias name


Oh, fair point. Not all shells support this apparently. zsh does:

    -> alias /usr/bin/sudo='ls -a'
    -> /usr/bin/sudo
     .  ..


Hm. How about ‘sudo’ <> ? i.e. quote the command?


If they have access to your .bashrc they can also alter your PATH and create a script named sudo somewhere they have write access to that carries the malicious payload. So you're not gaining much by adding the quotes.


Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.


At least in bash, quoting the command disables any alias. Maybe also in zsh?


zsh seems to have much more flexible alias rules than bash:

    > alias \'sudo\'='ls -a'
    > 'sudo'                
    .  ..




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: