I wont say anything so just enjoy this:
$ cd /tmp
$ ls
hydra-4.4-src sylpheed-1000
hydra-4.4-src.tar.gz xmms_rembrandt.0
$ rm -rf *
$ ls
$ touch ProofOfDumbness
$ ls -la
total 20
drwxrwxrwt 4 root wheel 512 Dec 30 05:39 .
drwxr-xr-x 15 root wheel 512 Dec 16 11:13 ..
drwxrwxrwt 2 root wheel 512 Dec 30 01:21 .ICE-unix
-r--r--r-- 1 rembrandt rembrandt 11 Dec 30 02:28 .X0-lock
drwxrwxrwt 2 root wheel 512 Dec 30 02:28 .X11-unix
-rw-r--r-- 1 rembrandt wheel 0 Dec 30 05:39 ProofOfDumbness
$ su
Password:
# chflags schg ProofOfDumbness
#
# ls -la
total 20
drwxrwxrwt 4 root wheel 512 Dec 30 05:39 .
drwxr-xr-x 15 root wheel 512 Dec 16 11:13 ..
drwxrwxrwt 2 root wheel 512 Dec 30 01:21 .ICE-unix
-r--r--r-- 1 rembrandt rembrandt 11 Dec 30 02:28 .X0-lock
drwxrwxrwt 2 root wheel 512 Dec 30 02:28 .X11-unix
-rw-r--r-- 1 rembrandt wheel 0 Dec 30 05:39 ProofOfDumbness
# rm ProofOfDumbness
#
override rw-r--r-- rembrandt/wheel for ProofOfDumbness? y
rm: ProofOfDumbness: Operation not permitted
# id
uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys), 4(tty),
5(operator), 20(staff), 31(guest)
# chflags noschg ProofOfDumbness
chflags: ProofOfDumbness: Operation not permitted
# hrhr... :-]
Even r00t can't delete all if he don't know what to do.
If you've any questions feel free to buy a UNIX Administrator Handbook
or start using manpages.
vH
> Is this a joke?
>
> root can delete any file...isn't that the point of being root? the
> fact that you can do anything with the system, regardless of
> permissions?
>
> -Sean
>
> Lennart Hansen wrote:
> > /bin/rm file access vulnerability
> >
> > Affected Products:
> > /bin/rm (all versions, tested on FreeBSD and linux)
> > (http://www.freebsd.org http://www.kernel.org)
> >
> > Author:
> > Xenzeo (Ablazed, Ultralaser, Lennart A. Hansen)
> > xenzeo at blackhat dot dk
> >
> >
> > /bin/rm is a program that removes the named file arguments on unix
> > systems. When /bin/rm is called it checks the file's permissions and
> > the id of the user trying to remove the file. If the user does not
> > have the required permissions to delete the file, /bin/rm will
> > simply reject and exit.
> >
> > However, it is possible for a person with admin rights (root) to
> > delete _any_ file
> > on the system regardless of who has created it and what it's
> > permissions are.
> >
> > Proof of concepts:
> > $ touch /home/xenzeo/file
> > $ ls -l /home/xenzeo/file
> > -rw-r--r-- 1 xenzeo none 0 Dec 30 2004 /home/xenzeo/file
> > $ id
> > uid=1000(xenzeo) gid=513(none) groups=513(none),545(users)
> > $ su -c 'rm -f /home/xenzeo/file'
> > $ ls -l /home/xenzeo/file
> > ls: file: No such file or directory
> >
> > #!/usr/bin/perl
> > if ($#ARGV != 0) {
> > die "usage: rm-exploit.pl file\r\n";
> > } else {
> > $file = $ARGV[0];
> > print "*** CMD: [ /bin/rm -f $file ]\r\n";
> > print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
> > if ($> == 0) {
> > print "[-] EXECUTING CMD\r\n";
> > system("/bin/rm -f $file");
> > print "[-] DONE\r\n";
> > print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
> > exit();
> > } else {
> > print "[-] EXPLOIT FAILED\r\n";
> > print "[-] YOU ARE NOT ROOT\r\n";
> > print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
> > }
> > }
> >
> > Vender status:
> > Neither FreeBSD nor Linux developers have been contacted
> > yet!
> >
> > -Xenzeo
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
Attachment:
pgp00086.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html