时间戳

首页 > 解决方案 > SUID exploit and patch

unix - SUID exploit and patch

问题描述

I am working on a SUID root binary 'app' that runs a system("ls -la /dir") command and managed to exploit it by writing a malicious ls to get root and changing my user's environment path to set it to higher priority than the kernel's one.

I noticed that executing it as user returns me root shell while executing it with sudo "./example" uses root's path and simply lists the files in dir. As far as i know setuid inherits owner's (in this case root) privileges to user and sudo executes as root.

What are such vulnerabilities called ? How would an app developer patch it? I there any way i can force user's to use sudo ./app to execute a program?

标签： unixprivileges

解决方案

我建议您更改应用程序以对其运行的命令使用绝对路径。例如：

system("/bin/ls -la /dir");

即使用户使用 sudo 命令执行它，他们也可以使用 sudo 参数 (--preserve-env) 来保留自己的 PATH。

如果您希望用户使用 sudo 运行应用程序，那么二进制文件不需要是 SUID root。

推荐阅读