Re: [Full-disclosure] Symlink vulnerabilities

[GloW - XD <doomxd@xxxxxxxxx>]

Yes... even adding a cron entry is possible if done right ;)


On 28 October 2011 04:51,  <Valdis.Kletnieks@xxxxxx> wrote:
> On Thu, 27 Oct 2011 10:31:12 PDT, Andrew Farmer said:
>> And systems like inotify make filesystem races trivial to win. I
>> wouldn't be surprised if you could win this particular race reliably by
>> watching for the files bzexe drops and acting immediately when they show
>> up.
>
> Good point.  That actually has multiple benefits - first off, you don't have a
> 'while (1)' loop in your code that's easily spotted on a 'ps' or 'top'.  So 
> you
> can afford to set the inotify and wait (potentially days, if needed) with less
> chance of detection.  And then when the inotify pops and tells you your file 
> is
> ready to be exploited, the circumstances of returning from the blocked syscall
> will tend to give your process a scheduling boost, improving your chances of
> winning the race because you'll schedule soon.
>
> It's amazing how many optimizations people are coming up for a vulnerability
> that some were saying is impossible to exploit. ;)
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/