No one expects command execution

#1

Post by wglb » Fri, Jul 03, 2015, 4:15 PM UTC

No one expects command execution
0x90909090.blogspot.com

Re: No one expects command execution

#2

Post by orf » Fri, Jul 03, 2015, 4:29 PM UTC

I don't get it, it's not really unexpected if you pass the name of the executable (which just happens to be a script) via a flag... used explicitly for passing an executable to run.

I mean, is it unexpected if `./my_command --execute-this-right-now=somescript.sh` executes somescript.sh?

Re: No one expects command execution

#3

Post by ushi » Fri, Jul 03, 2015, 4:38 PM UTC

orf wrote: post #2

I don't get it, it's not really unexpected if you pass the name of the executable (which just happens to be a script) via a flag... used explicitly for passing an executable to run. I mean, is it unexpected if `./my_command --execute-this-right-now=somescript.sh` executes somescript.sh?

I agree. Every single example in this article makes perfect sense to me.

Re: No one expects command execution

#4

Post by Retr0spectrum » Fri, Jul 03, 2015, 4:39 PM UTC

Are there any real examples of how this could be used to do something malicious?

Re: No one expects command execution

#5

Post by strictfp » Fri, Jul 03, 2015, 4:39 PM UTC

orf wrote: post #2

I don't get it, it's not really unexpected if you pass the name of the executable (which just happens to be a script) via a flag... used explicitly for passing an executable to run. I mean, is it unexpected if `./my_command --execute-this-right-now=somescript.sh` executes somescript.sh?

I think he wants to bring to peoples attention that if you give someone sudo rights for a specific program chances are that they will be able to elevate their privilegies.

Re: No one expects command execution

#6

Post by joeyh » Fri, Jul 03, 2015, 4:41 PM UTC

Command execution is overrated. How about having tar download an arbitrary tar file over the network, from a server you control? http://bugs.debian.org/290435

Re: No one expects command execution

#7

Post by reubenmorais » Fri, Jul 03, 2015, 4:41 PM UTC

orf wrote: post #2

I don't get it, it's not really unexpected if you pass the name of the executable (which just happens to be a script) via a flag... used explicitly for passing an executable to run. I mean, is it unexpected if `./my_command --execute-this-right-now=somescript.sh` executes somescript.sh?

I guess the author's point is don't ever, ever, ever mix shells and unsanitized user inputs, even if you think it can't possibly be harmful.

In other words, even if it's not obvious, doing this creates a security vulnerability:

    tar bla bla ${user input}

Re: No one expects command execution

#8

Post by schoen » Fri, Jul 03, 2015, 4:43 PM UTC

Retr0spectrum wrote: post #4

Are there any real examples of how this could be used to do something malicious?

Probably strictfp's example above of allowing someone to run specific commands with sudo.

In the past there were also various implementations of a "restricted shell"; it's conceivable that some of these could bypass a restricted shell's restrictions, depending on how they were implemented.

Re: No one expects command execution

#9

Post by Retr0spectrum » Fri, Jul 03, 2015, 4:44 PM UTC

orf wrote: post #2

I don't get it, it's not really unexpected if you pass the name of the executable (which just happens to be a script) via a flag... used explicitly for passing an executable to run. I mean, is it unexpected if `./my_command --execute-this-right-now=somescript.sh` executes somescript.sh?

It isn't much different from something like

    echo `somescript.sh`

Re: No one expects command execution

#10

Post by tptacek » Fri, Jul 03, 2015, 4:48 PM UTC

Retr0spectrum wrote: post #4

Are there any real examples of how this could be used to do something malicious?

Sure: any attempt to build a "sandboxed" command line interface with a shell, or any web app that shells out to one of these commands and passes user input as an argument.