31–40 of 67 posts
Warning, website wont load at all unless JavaScript is enabled.
I don’t get why people use those kind of shitty frameworks for sites that don’t require interactive content.
When you control environment variables, can't you also LDPRELOAD scary stuff?
We were also unable to control the contents of a file on disk, and bruteforcing process identifiers (PIDs) and file descriptors found no interesting results, eliminating remote LD_PRELOAD exploitation.When you control environment variables, can't you also LDPRELOAD scary stuff?
This was a huge component of a 2020 DEFCON CTF qualifier challenge that only Samurai and PPP solved, where you had to get code execution or arbitrary file read out of as many setuid binaries as possible, after installing basically every cli Debian package and changing them to setuid. There are some very interesting ways to load shared objects or read files with environment variables, and we even found ways to leverag…
When you control environment variables, can't you also LDPRELOAD scary stuff?
Or just set $PATH to a directory you control containing an "ls" binary. I don't understand what this post is on about at all - is it implying they've discovered a way to control environment variables of unrelated processes or users?
> We were also unable to control the contents of a file on disk
From the first and second sentence.
I wonder whether it is still the case nowadays. Is CGI still being used?
Warning, website wont load at all unless JavaScript is enabled.
This was a huge component of a 2020 DEFCON CTF qualifier challenge that only Samurai and PPP solved, where you had to get code execution or arbitrary file read out of as many setuid binaries as possible, after installing basically every cli Debian package and changing them to setuid. There are some very interesting ways to load shared objects or read files with environment variables, and we even found ways to leverag…
Earlier quoted context omitted.
Or just set $PATH to a directory you control containing an "ls" binary. I don't understand what this post is on about at all - is it implying they've discovered a way to control environment variables of unrelated processes or users?
> On a recent project we gained the ability to specify environment variables > We were also unable to control the contents of a file on disk From the first and second sentence.