Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

twitter.com

Post reply on HN
Print view View original

21–30 of 74 posts

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#21

Post by simias »

nwh wrote: post #16
dazzawazza wrote: post #14

From the FreeBSD man for date Only the superuser may set the date, and if the system securelevel (see securelevel(7)) is greater than 1, the time may not be changed by more than 1 second. EDIT: so you need to be root anyway or have root access to change the date.

Users on MacOS can change the time without root access.

Are you sure? If it is it sounds like a possible security issue. Time is pretty sensitive as soon as certificates are involved. Many auth systems assume the clock is properly synchronized across the system.

If that's true IMO that's the security issue, not the arguably strange behaviour of sudo in a situation that should never occur.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#23

Post by hosay123 »

jrockway wrote: post #15

TL;DR: users in /etc/sudoers can run code as root with sudo.

An evil person with e.g. a stolen SSH key can escalate privileges on a machine without needing the user's password. It's not simply about sudo working as designed, it allows bypassing sudo's user authentication entirely.

I can think of a handful of corporate machines (e.g. web servers) I've had pubkey access on where sudo allowed the real admin to gain root from the same account via sudo.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#25

Post by simias »

nsmartt wrote: post #13
mnarayan01 wrote: post #12

From the vulnerability announcement, it seems like this only allows a user to "set" NOPASSWD for that user's sudo regardless of what's in sudoers. It also doesn't seem to allow escalation beyond what's in sudoers. Am I missing something?

It sounds like you're overlooking the fact that software could do this without your knowledge.

Software that can do this could also just wait for you to run a sudo command and then install a rootkit before the timeout is reached. Or it could keylog your password.

On desktop machines getting root is almost useless, you have all the sensitive information on the user account. Unless the attacker wants to install a rootkit in the kernel or open raw sockets or stuff like that. But if they can run arbitrary code with your UID you've probably already lost anyway.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#26

Post by brokentone »

JoachimSchipper wrote: post #11
mpyne wrote: post #4

Interesting! Does sudo somehow get confused about checking for a password at all when the current date is the UNIX epoch? I wonder, does this require the user to be listed in sudoers with any privileges or is it just straight to root?

This gives you only the privileges that a successful "sudo" would give you, and requires a previous successful "sudo". It's a nice hack, but hardly the end of the world.

It is, however, the beginning of the UNIX world

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#28

Post by derekp7 »

mpyne wrote: post #6
grimtrigger wrote: post #3

Can someone explain this a little more?

sudo -k resets the "needs a password to be entered" flag by changing the last-password-entered time to appear to be the UNIX epoch (time 0). If you then change the date to be the same day (which can be done without root permissions in modern Linux distros by using polkit or similar things), then you can use sudo to run commands as root without a password. Presumably, sudo checks the 'last-successful-login' entry alon…

So there are two ways I can see to fix this. Either make setting the time always requires a password, or, add a signal that time-sensitive processes can listen to that gets tripped whenever time is altered.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#29

Post by rplnt »

nwh wrote: post #16
dazzawazza wrote: post #14

From the FreeBSD man for date Only the superuser may set the date, and if the system securelevel (see securelevel(7)) is greater than 1, the time may not be changed by more than 1 second. EDIT: so you need to be root anyway or have root access to change the date.

Users on MacOS can change the time without root access.

System time or what is displayed to the user? Because they are two different things on some systems.

Re: Run sudo -k, set your clock to 01.01.1970, run sudo su and boom you're root

#30

Post by __alexs »

hosay123 wrote: post #23
jrockway wrote: post #15

TL;DR: users in /etc/sudoers can run code as root with sudo.

An evil person with e.g. a stolen SSH key can escalate privileges on a machine without needing the user's password. It's not simply about sudo working as designed, it allows bypassing sudo's user authentication entirely. I can think of a handful of corporate machines (e.g. web servers) I've had pubkey access on where sudo allowed the real admin to gain root from the same account via sudo.

How are they going to change the date without having a path to superuser access already?
Post reply on HN