Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

root with a single command: sudo logrotate

joshua.hu

Post reply on HN
Print view View original

31–40 of 51 posts

Re: root with a single command: sudo logrotate

#31

Post by jchw »

c22 wrote: post #30
jchw wrote: post #26

Earlier quoted context omitted.

I'm a bit miffed that people are getting downvoted for not realizing this is not the default behavior, when I have no idea how you were supposed to gather that from reading the article. I did actually check to see (in Ubuntu 23.04) but honestly, that doesn't clear up much given that I have no idea what different installation modes of Ubuntu may yield. Yeah, it's fair enough that it completely negates all of the point…

People don't get downvoted. Posts get downvoted, sometimes for inaccuracy. Tough break.

Yeah, nobody really cares about the dumb number next to the posts anyway. What's actually annoying is being misunderstood, because the article seems to have produced mainly two comments:

1. "That's a pretty bad default." (it would be, after all.)

2. "That scenario is quite contrived."

The former is just a misunderstanding, but I think the reason why it happened is simple: the article is written in a way that doesn't really make it clear whether it is a condition they added or a condition they observed. On the other hand, giving someone the benefit of the doubt, I personally assumed that it was unlikely someone would intentionally add this, since it's, well, you know... Quite contrived.

I think I understand the purpose now (it's intentionally contrived, merely for practice with probably a less contrived setup in the future) and I hate to be overly harsh on the article, since it's perfectly fine for someone's personal blog, but when I see something on HN's frontpage, I generally have some expectation for how interesting it is. After all, plenty of genuinely very interesting things die in new, why would this make it out? Alas, sometimes it just happens.

Re: root with a single command: sudo logrotate

#32

Post by TrickardRixx »

jchw wrote: post #31
c22 wrote: post #30

Earlier quoted context omitted.

People don't get downvoted. Posts get downvoted, sometimes for inaccuracy. Tough break.

Yeah, nobody really cares about the dumb number next to the posts anyway. What's actually annoying is being misunderstood, because the article seems to have produced mainly two comments: 1. "That's a pretty bad default." (it would be, after all.) 2. "That scenario is quite contrived." The former is just a misunderstanding, but I think the reason why it happened is simple: the article is written in a way that doesn't…

My takeaway from reading all this is that there is no reason this article should have made it to the front page of HN, as all it did was create confusion and burn 10 minutes of my time trying to clarify what was happening. Nothing about this article or the discussion it has created is interesting, just frustrating.

Re: root with a single command: sudo logrotate

#34

Post by wgjordan »

jchw wrote: post #26
richbell wrote: post #8

Earlier quoted context omitted.

The post doesn't do a good job explaining whether this is the stock configuration or purely a hypothetical. My initial reaction was the same as yours, but upon further reflection I get the feeling it's just a thought exercise.

I'm a bit miffed that people are getting downvoted for not realizing this is not the default behavior, when I have no idea how you were supposed to gather that from reading the article. I did actually check to see (in Ubuntu 23.04) but honestly, that doesn't clear up much given that I have no idea what different installation modes of Ubuntu may yield. Yeah, it's fair enough that it completely negates all of the point…

"Please don't comment about the voting on comments. It never does any good, and it makes boring reading."

https://news.ycombinator.com/newsguidelines.html

It's also a bit disingenuous to make a third-person reference to your own post ('people are getting downvoted').

Re: root with a single command: sudo logrotate

#35

Post by mmsc »

gorkish wrote: post #24

I too can break into my own house when I leave a door wide open for myself. There is nothing wrong with logrotate, ubuntu, ssh, or sudo here. Once you are passing arbitrary strings to bash as root -- yeah it's gonna be game over. This reminds me of the time a pentester found an XSS vuln and spent the entire rest of the engagement stuffing a keylogger into it. Like, OK, thanks, we already understand the implications o…

OP here: I never said it's something wrong with logrotate, ubuntu, ssh, or sudo. It's a thought challenge with a guide, and could be a stage in a CTF challenge to get root.

It's "something wrong" with the configuration chosen by a system administrator to allow "/usr/sbin/logrotate *" to be run as root without consideration of what the logrotate binary may do with certain arguments.

It's just an explanation of how to exploit this situation if you find a server using this type of configuration. That's the whole basis of projects like https://gtfobins.github.io/ and https://gtfoargs.github.io/.

  As I have seen this style of script being used with forced commands in authorized_keys, my conclusion is that the author loosely followed some online guide for restricting SSH access to certain commands and either inherited the flawed original script or made the error adapting it to the local requirements.
  Proper options for restricting the shell abound. From the top of my head: rssh, sshdo, PolicyKit, rbash, rush
Did you actually read the article at all? If you use rbash or rshell and logrotate can be run as root, this issue still persists. The logrotate binary is the one performing these actions, not bash.

  Once you are passing arbitrary strings to bash as root
Passing arbitrary strings to bash as root? It's about passing arbitrary arguments to logrotate.

Re: root with a single command: sudo logrotate

#36

Post by blibble »

orange-mentor wrote: post #23
fuzzybear3965 wrote: post #6

I think PolKit can be used to delegate fine-grained control to users. Which other tools are available on Linux to control users' access to fs and network resources? File permissions, systemd-nspawn?

One could write a very small custom binary in C/C++/Rust that runs the command, and then give that binary setuid permissions. That binary can simply run a subprocess, and nothing else.

you could call it "sudo"

Re: root with a single command: sudo logrotate

#37

Post by Retr0id »

gorkish wrote: post #24

I too can break into my own house when I leave a door wide open for myself. There is nothing wrong with logrotate, ubuntu, ssh, or sudo here. Once you are passing arbitrary strings to bash as root -- yeah it's gonna be game over. This reminds me of the time a pentester found an XSS vuln and spent the entire rest of the engagement stuffing a keylogger into it. Like, OK, thanks, we already understand the implications o…

last time I checked (several years ago), rbash is full of security holes, and while those may have been patched now I really would not trust it to lock down a privileged shell session.

Re: root with a single command: sudo logrotate

#38

Post by skilled »

Levitating wrote: post #27

There's a whole site dedicated to commands like this: https://gtfobins.github.io

Nice!

Some previous discussions about it on HN,

GTFOBins (https://news.ycombinator.com/item?id=28849101) - October 2021 (54 comments)

List of Unix binaries that can be used to bypass local security restrictions (https://news.ycombinator.com/item?id=36628976) - July 2023 (99 comments)

Living Off the Land in Linux (https://news.ycombinator.com/item?id=20648329) - August 2019 (35 comments)

Re: root with a single command: sudo logrotate

#40

Post by mmsc »

blueflow wrote: post #7

sudo /usr/sbin/$SSH_ORIGINAL_COMMAND By the way: SSH_ORIGINAL_COMMAND is a command like you would give to sh -c, basically a tiny snippet of sh code. Its not an argument vector! You either need a shell to kind of eval it or parse it with wordexp(3) before you can reliably tell which executable name it refers to. Mean people might send one starting with '$(' or another expansion. Remember this is valid: ssh host '$(ec…

With the following test.sh:

  #!/bin/bash
  case "$SSH_ORIGINAL_COMMAND" in
      *)
          sudo $SSH_ORIGINAL_COMMAND
          ;;
  esac
and the ssh-based restriction:

  command="/tmp/test.sh"

  $ ssh user@server 'uname > /tmp/123'
  uname: extra operand ‘>’
  Try 'uname --help' for more information.
  $ ssh user@server 'uname $(ls)'
  uname: extra operand ‘$(ls)’
  Try 'uname --help' for more information.
Post reply on HN