No one expects command execution • Hacker News Board

Re: No one expects command execution

#41

Post by WalterBright » Fri, Jul 03, 2015, 6:07 PM UTC

supertruth wrote: post #33

WalterBright wrote: post #18

What I find interesting is the thread title being a pun from a 40 year old movie. Back in the 70s, there wasn't any interest in movies, music, etc. from the 30s. And there still isn't interest in 30s culture, but plenty in the 70s. I wonder why.

I think you're in a bubble. Lots of people have interest in the 30s given it was the golden age of Hollywood: Gone with the Wind references have entered the cultural lexicon, so have The Wizard of Oz references.

A movie from the 70s that compares with TWoO and GWTW in stature would be Star Wars, certainly not MPatHG.

I find it unremarkable that people today quote SW.

Re: No one expects command execution

#42

Post by flgr » Fri, Jul 03, 2015, 6:09 PM UTC

JonnieCache wrote: post #23

krylon wrote: post #20

Earlier quoted context omitted.

Perl has a special "taint" mode (Ruby does, too, I think, but I don't know about the differences or similarties), where any data coming from outside the program - environment variables, network connections, files, etc. - is considered "tainted", i.e. treated as bad , until you validate it using regular expressions (or something along those lines). I have to admit I never tried it, but it sounds like a good idea, assu…

Rails has ActiveSupport::SafeBuffer for doing XSS protection, but ruby doesn't track external strings as dirty like that.

> but ruby doesn't track external strings as dirty like that.

It does:

  irb(main):001:0> gets.tainted?
  foo
  => true

You can even set $SAFE to 1 or higher to disallow the use of tainted strings in potentially dangerous commands:

  freya:~ flgr$ ruby -e '$SAFE = 1; system "tar bla bla #{gets}"'
  foo
  -e:1:in `system': Insecure operation: -r (SecurityError)
	  from -e:1:in `'

See http://phrogz.net/programmingruby/taint.html for more information.

Re: No one expects command execution

#43

Post by elchief » Fri, Jul 03, 2015, 6:09 PM UTC

There must be a bug in my OpenBSD, because none of these work...

Re: No one expects command execution

#44

Post by digi_owl » Fri, Jul 03, 2015, 6:10 PM UTC

subway wrote: post #15

orf wrote: post #2

I don't get it, it's not really unexpected if you pass the name of the executable (which just happens to be a script) via a flag... used explicitly for passing an executable to run. I mean, is it unexpected if `./my_command --execute-this-right-now=somescript.sh` executes somescript.sh?

I've seen a lot of novice sysadmins do silly things like rely on sudo's command restrictions, expecting this to actually contain a user. For those sysadmins, yeah, it's unexpected.

All security is a matter of degree, be it computing or physical.

the most determined of attackers will always find a way in.

Re: No one expects command execution

#45

Post by vidarh » Fri, Jul 03, 2015, 6:14 PM UTC

JonnieCache wrote: post #23

krylon wrote: post #20

Earlier quoted context omitted.

Perl has a special "taint" mode (Ruby does, too, I think, but I don't know about the differences or similarties), where any data coming from outside the program - environment variables, network connections, files, etc. - is considered "tainted", i.e. treated as bad , until you validate it using regular expressions (or something along those lines). I have to admit I never tried it, but it sounds like a good idea, assu…

Rails has ActiveSupport::SafeBuffer for doing XSS protection, but ruby doesn't track external strings as dirty like that.

> but ruby doesn't track external strings as dirty like that.

Yes, it does. E.g:

    x = STDIN.gets
    puts x.tainted?
    y = "hello "+x
    puts y.tainted?
    z = "foo"
    puts z.tainted?

The two first will return "true", and the last will print "false". If you set the safe-level appropriately some methods will be disallowed for x and y above (e.g. eval()), though I would not trust that as comprehensive, but it's a lot better than nothing.

Re: No one expects command execution

#46

Post by jcape » Fri, Jul 03, 2015, 6:17 PM UTC

If your ~/.bashrc is a SYMLINK to a bash or sh script, bash will AUTOMATICALLY EXECUTE that script on login.

If you give rsync command a source or destination with an unescaped colon, it will read an ENVIRONMENT VARIABLE to figure out a command to run to AUTOMATICALLY CONNECT TO ARBITRARY NETWORK RESOURCES. If you have keys, it will even SKIP PASSWORD ENTRY, and with default Kerberos, it will not only skip password, but make a network connections to a login server:port specified by a DNS ENTRY.

Seriously, who is this guy, and why is this trainwreck #1 on HN?

Re: No one expects command execution

#47

Post by [deleted] » Fri, Jul 03, 2015, 6:23 PM UTC

jcape wrote: post #46

If your ~/.bashrc is a SYMLINK to a bash or sh script, bash will AUTOMATICALLY EXECUTE that script on login. If you give rsync command a source or destination with an unescaped colon, it will read an ENVIRONMENT VARIABLE to figure out a command to run to AUTOMATICALLY CONNECT TO ARBITRARY NETWORK RESOURCES. If you have keys, it will even SKIP PASSWORD ENTRY, and with default Kerberos, it will not only skip password,…

[deleted]

Re: No one expects command execution

#48

Post by dlsym » Fri, Jul 03, 2015, 6:24 PM UTC

Hey guys! Did you know you can actually execute a script with date by running date && ./myscript.sh

WOW! I better get on going writing my blog post "executing abitrary code with 'date'".

Re: No one expects command execution

#49

Post by haberman » Fri, Jul 03, 2015, 6:26 PM UTC

dlsym wrote: post #48

Hey guys! Did you know you can actually execute a script with date by running date && ./myscript.sh WOW! I better get on going writing my blog post "executing abitrary code with 'date'".

Doesn't count, a setuid date wouldn't get you root with that command.

Re: No one expects command execution

#50

Post by juhanima » Fri, Jul 03, 2015, 6:28 PM UTC

Blackthorn wrote: post #27

cbd1984 wrote: post #19

Earlier quoted context omitted.

> UNIX got battle-hardened during its college years Is that when it finally gave up making shar archives? For the unitiated: A shar is a "shell archive", or a shell script which (typically) makes heavy use of 'here documents' to do what tarballs do, only they're shell scripts so you have to execute them and then they can potentially execute arbitrary code unless you read through them very closely and actually underst…

I don't really understand how a shar is more dangerous than the still-incredibly-common "./configure; make".

And even without any other source of trust, anyone who is willing to go through the automake/config hell, already scored some initial trust points. I rest my case.