No one expects command execution

Post by schoen » Fri, Jul 03, 2015, 6:46 PM UTC

huherto wrote: post #21

cbd1984 wrote: post #19

Earlier quoted context omitted.

> UNIX got battle-hardened during its college years Is that when it finally gave up making shar archives? For the unitiated: A shar is a "shell archive", or a shell script which (typically) makes heavy use of 'here documents' to do what tarballs do, only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually underst…

I loved shars. It was a carefree time. Nothing to worry about.

Post by Gibbon1 » Fri, Jul 03, 2015, 6:58 PM UTC

ninkendo wrote: post #37

andrey-p wrote: post #34

Earlier quoted context omitted.

But if you're plugging in input like that, couldn't the malicious user just pass in something like && sudo rm -rf / anyway? Which would render the whole point of the article moot.

There's simple ways to "escape" user input (as in, ensure the whole input string is interpreted as a single argument to this program) in ways that ensure you can't do simple &&'s or ;'s and execute a totally different command. But the point of the article is even if it's properly escaped, users can still do malicious things when input is passed to lots of standard UNIX utilities.

Post by __david__ » Fri, Jul 03, 2015, 7:00 PM UTC

ninkendo wrote: post #37

andrey-p wrote: post #34

Earlier quoted context omitted.

But if you're plugging in input like that, couldn't the malicious user just pass in something like && sudo rm -rf / anyway? Which would render the whole point of the article moot.

There's simple ways to "escape" user input (as in, ensure the whole input string is interpreted as a single argument to this program) in ways that ensure you can't do simple &&'s or ;'s and execute a totally different command. But the point of the article is even if it's properly escaped, users can still do malicious things when input is passed to lots of standard UNIX utilities.

    tar c -- "$directory_to_tar"

Post by __david__ » Fri, Jul 03, 2015, 7:06 PM UTC

haberman wrote: post #49

dlsym wrote: post #48

Hey guys! Did you know you can actually execute a script with date by running date && ./myscript.sh WOW! I better get on going writing my blog post "executing abitrary code with 'date'".

Doesn't count, a setuid date wouldn't get you root with that command.

Post by wglb » Fri, Jul 03, 2015, 7:18 PM UTC

jcape wrote: post #46

If your ~/.bashrc is a SYMLINK to a bash or sh script, bash will AUTOMATICALLY EXECUTE that script on login. If you give rsync command a source or destination with an unescaped colon, it will read an ENVIRONMENT VARIABLE to figure out a command to run to AUTOMATICALLY CONNECT TO ARBITRARY NETWORK RESOURCES. If you have keys, it will even SKIP PASSWORD ENTRY, and with default Kerberos, it will not only skip password,…