CVE-2017-16544: A Busybox autocompletion vulnerability
1–10 of 15 posts
Re: CVE-2017-16544: A Busybox autocompletion vulnerability
#2I find these type of vulnerabilities very interesting.
I've also seen a sysop once using curl or wget in such a way that it would print out the response, while checking for an image file; it outputted all kinds of special characters. Then, afer some magic character was printed, their terminal would start interpreting the rest of the output as commands. The commands were gibberish, nothing happened, but very dangerous nonetheless.
Re: CVE-2017-16544: A Busybox autocompletion vulnerability
#3This is quite ungood considering how many devices (read: routers, IoT) have busybox (or some zombie-like corpse of it) installed on them.
Re: CVE-2017-16544: A Busybox autocompletion vulnerability
#4This is quite ungood considering how many devices (read: routers, IoT) have busybox (or some zombie-like corpse of it) installed on them.
Hi, I'm the author of the article. To stress your point, there really are so many embedded devices using Busybox, and most of them were never designed to be updated (or nobody cares enough to update them).
Also I never got to fuzzing networking applets (wget is the most obvious) but this is definitely something I plan to look into, if no one did that before, there are definitely vulnerabilities there too.
Re: CVE-2017-16544: A Busybox autocompletion vulnerability
#5This is quite ungood considering how many devices (read: routers, IoT) have busybox (or some zombie-like corpse of it) installed on them.
It could be good for me. We ($work) have some embedded devices running BusyBox that we only have limited (i.e. non-root) access to. I'm looking forward for a way to escalate privileges on these devices as a result of this!
Re: CVE-2017-16544: A Busybox autocompletion vulnerability
#6This is quite ungood considering how many devices (read: routers, IoT) have busybox (or some zombie-like corpse of it) installed on them.
Hi, I'm the author of the article. To stress your point, there really are so many embedded devices using Busybox, and most of them were never designed to be updated (or nobody cares enough to update them). Also I never got to fuzzing networking applets (wget is the most obvious) but this is definitely something I plan to look into, if no one did that before, there are definitely vulnerabilities there too.
When you ssh to your device are you not running Busybox shell on the device? I don't understand why this is less of a problem?
Re: CVE-2017-16544: A Busybox autocompletion vulnerability
#7Earlier quoted context omitted.
Hi, I'm the author of the article. To stress your point, there really are so many embedded devices using Busybox, and most of them were never designed to be updated (or nobody cares enough to update them). Also I never got to fuzzing networking applets (wget is the most obvious) but this is definitely something I plan to look into, if no one did that before, there are definitely vulnerabilities there too.
When you ssh to your device are you not running Busybox shell on the device? I don't understand why this is less of a problem?
Yes absolutely. Whew. Updated my comment accordingly, thanks.
Re: CVE-2017-16544: A Busybox autocompletion vulnerability
#8I find these type of vulnerabilities very interesting. I've also seen a sysop once using curl or wget in such a way that it would print out the response, while checking for an image file; it outputted all kinds of special characters. Then, afer some magic character was printed, their terminal would start interpreting the rest of the output as commands. The commands were gibberish, nothing happened, but very dangerous…
> Then, afer some magic character was printed, their terminal would start interpreting the rest of the output as commands. The commands were gibberish, nothing happened, but very dangerous nonetheless.
By commands, you probably mean "escape sequences", which are not the same as running executables and isn't very dangerous.
If a terminal actually executed commands based on data printed to stdout, that would be a very significant vulnerability. It seems far more likely that the gibberish you're talking about is the usual mess of escape sequences.
Re: CVE-2017-16544: A Busybox autocompletion vulnerability
#9This is quite ungood considering how many devices (read: routers, IoT) have busybox (or some zombie-like corpse of it) installed on them.
The vulnerability is that you can play tricks on interactive users' output. In general people (besides nerds) aren't shelling into these devices so it really doesn't seem like that big of a deal.
Re: CVE-2017-16544: A Busybox autocompletion vulnerability
#10This is quite ungood considering how many devices (read: routers, IoT) have busybox (or some zombie-like corpse of it) installed on them.
It could be good for me. We ($work) have some embedded devices running BusyBox that we only have limited (i.e. non-root) access to. I'm looking forward for a way to escalate privileges on these devices as a result of this!
How do you get privilege escalation from shell escape sequences?