Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

#include

blog.hboeck.de

Post reply on HN
Print view View original

81–90 of 132 posts

Re: #include </etc/shadow>

#81

Post by softwarelimits »

Did you try this on an up2date Linux OS, like eg Debian or Ubuntu? What was your result?

Certainly as a real hacker you are not only re-posting "things from the news" but validate everything before posting any comments? Are you?

I did not see any relevant content on the websites you mention in your HN profile, I expected some in-depth security publications - maybe update it with some real code that shows us how you are using the mentioned CVE-2019-14378 to perform escapes on any KVM host? Thanks!

Re: #include </etc/shadow>

#82

Post by softwarelimits »

zonidjan wrote: post #39

> Recently I saw a tweet where someone mentioned that you can include /dev/stdin in C code compiled with gcc. This is, to say the very least, surprising. You can also call something to read from stdin in your Makefile, or read from stdin in your executable. > But is it equally obvious that the compiler also needs to be sandboxed? Yes. Why wouldn't it be sandboxed?! > I even found one service that ... showed me the ha…

If that was my server I would of course put a joke in /etc/shadow - did you try to brute force the hashes? It would not be a great surprise to find some obvious funny content if you try?

Re: #include </etc/shadow>

#83

Post by softwarelimits »

jacquesm wrote: post #75
arpa wrote: post #72

Earlier quoted context omitted.

Please do share how can one escape qemu.

At your service: https://www.techrepublic.com/article/vm-escape-flaw-in-qemu-...

Did you try this on an up2date Linux OS, like eg Debian or Ubuntu? What was your result?

Certainly as a real hacker you are not only re-posting "things from the news" but validate everything before posting any comments? Are you?

I did not see any relevant content on the websites you mention in your HN profile, I expected some in-depth security publications - maybe update it with some real code that shows us how you are using the mentioned CVE-2019-14378 to perform escapes on any KVM host? Thanks!

Re: #include </etc/shadow>

#85

Post by fwsgonzo »

shawabawa3 wrote: post #71
fwsgonzo wrote: post #61

You can compile and execute C/C++ code in my little hobby project: https://droplet.fwsnet.net/ It's something I use to measure certain things, like how many instructions does a C++ exception add etc. It's run in a docker container, and I think I strip out any slashes from includes. I'm pretty sure the container is not executing stuff as root as well. Still, probably not bulletproof.

You aren't stripping slashes. I tried `#include ` and it eventually crashes the container failing to allocate memory (looks like they have a 4GB limit?)

Haha, that's clever. Yes, it's a 4GB limit. Guess I'll try to fix that again. EDIT: fixed

Re: #include </etc/shadow>

#86

Post by VBprogrammer »

softwarelimits wrote: post #83
jacquesm wrote: post #75

Earlier quoted context omitted.

At your service: https://www.techrepublic.com/article/vm-escape-flaw-in-qemu-...

Did you try this on an up2date Linux OS, like eg Debian or Ubuntu? What was your result? Certainly as a real hacker you are not only re-posting "things from the news" but validate everything before posting any comments? Are you? I did not see any relevant content on the websites you mention in your HN profile, I expected some in-depth security publications - maybe update it with some real code that shows us how you a…

I'm trying to understand what your point is, are you denying that there was a vulnerability?

As it stands it just sounds like you are just being a jerk on the internet.

Re: #include </etc/shadow>

#89

Post by fnord77 »

jedisct1 wrote: post #87

And in Rust you can use the `include_str!()` macro to include any file. Works well on the Rust playground and pretty much everywhere else: https://play.rust-lang.org/?version=stable&mode=debug&editio... If procedural macros are available, they can also be abused to run arbitrary code.

and if you look at this file "/proc/1/cgroup"

you'll see that it is isolated in a docker container

Re: #include </etc/shadow>

#90

Post by yholio »

softwarelimits wrote: post #83
jacquesm wrote: post #75

Earlier quoted context omitted.

At your service: https://www.techrepublic.com/article/vm-escape-flaw-in-qemu-...

Did you try this on an up2date Linux OS, like eg Debian or Ubuntu? What was your result? Certainly as a real hacker you are not only re-posting "things from the news" but validate everything before posting any comments? Are you? I did not see any relevant content on the websites you mention in your HN profile, I expected some in-depth security publications - maybe update it with some real code that shows us how you a…

The idea is that virtualization escape vulnerabilities are quite frequent. An attacker might not have one on hand at any given moment and you might patch your system frequently when they become known.

But this only means a determinated attacker that has emulated root needs only patience. Good security always means stacked independent layers, betting the farm only on the guarantees of your VM is very unsafe.

Post reply on HN