Exploiting ELF Expansion Variables
backtrace.io
Exploiting ELF Expansion Variables
1–5 of 5 posts
Re: Exploiting ELF Expansion Variables
#2For those interested in CTFs techniques or an intro to system exploitation, this is a good read.
Re: Exploiting ELF Expansion Variables
#3> In IllumOS non-privileged users are allowed to create hard links of setuid executables which is necessary in order for exploitation of this vulnerability to achieve privileged code execution.
> NOTE: Various Linux distributions have incorporated patches that restrict symbolic link behavior, preventing security vulnerabilities such as the one we are about to demonstrate.
Linux distributions also restrict hardlink behavior, which addresses this issue. This seems like the key point. In current Linux, by default, you can't create a hardlink to someone else's file, setuid or otherwise.
Re: Exploiting ELF Expansion Variables
#4> In IllumOS non-privileged users are allowed to create hard links of setuid executables which is necessary in order for exploitation of this vulnerability to achieve privileged code execution. > NOTE: Various Linux distributions have incorporated patches that restrict symbolic link behavior, preventing security vulnerabilities such as the one we are about to demonstrate. Linux distributions also restrict hardlink be…
And also the Linux kernel has protections against unsafe symlinks too[1].
Re: Exploiting ELF Expansion Variables
#5Hm, might the changes to Android's dynamic linking behavior described here [0] also be related to similar actual or possible attack vectors?
[0] http://android-developers.blogspot.de/2016/06/android-change...