tmux Privilege Escalation
markdownbin.com
tmux Privilege Escalation
1–10 of 40 posts
Re: tmux Privilege Escalation
#2> A script run as user in tmux can under some circumstances execute commands as root.
Re: tmux Privilege Escalation
#3... only if you have another pane with root logged in or with sudo authorized.
Re: tmux Privilege Escalation
#4This feels like using “keyboard privilege escalation” to mean an attacker could type on your physical keyboard to access a terminal logged in as root to execute commands.
Re: tmux Privilege Escalation
#5... only if you have another pane with root logged in or with sudo authorized.
Which is normal if you want to maintain only a single ssh session to a remote machine.
Re: tmux Privilege Escalation
#6Something running with your privileges could similarly use your existing sudo ticket, or manipulate the memory of your terminal emulator, or modify your shell to grab your credentials the next time you authenticate (and pass those to sudo), etc.
This isn't tmux's fault; this is fundamentally the sort of thing that's possible under the security model of modern Linux desktops.
Re: tmux Privilege Escalation
#7This feels like using “keyboard privilege escalation” to mean an attacker could type on your physical keyboard to access a terminal logged in as root to execute commands.
Haha. I thought the same. But here, what is interesting is that, an attacker could easily run a background process which quietly monitors the tmux panes, and execute privileged instructions once a root pane has started. The user would never even know.
Re: tmux Privilege Escalation
#8And any program running in an X11 session can fake keystrokes and thereby escalate privileges in a similar fashion. It's not exactly a vulnerability unique to tmux.
Re: tmux Privilege Escalation
#9This feels like using “keyboard privilege escalation” to mean an attacker could type on your physical keyboard to access a terminal logged in as root to execute commands.
Haha. I thought the same. But here, what is interesting is that, an attacker could easily run a background process which quietly monitors the tmux panes, and execute privileged instructions once a root pane has started. The user would never even know.
An attacker could also ptrace into a shell, do mitm with an extra pseudo terminal when the user types su or sudo, and grab the password.
The permission model used in UNIX is just that weak. This is why there's so much going on around capability-based operating systems (mostly built around 3rd generation microkernels such as seL4), like Genode.
Re: tmux Privilege Escalation
#10Do we consider it a vulnerability to put "alias sudo=sudo rm -rf /" in your shell config too?
How about ptrace(), depending on how your system is configured, an attacker running under your own user account could do similar damage to any process you run, make your browser display fake login forms, steal saved application passwords, etc.
Once someone has access to your the user account of someone with sudo it's game over, there's just too many ways to elevate, I couldn't even name them all. They could even just straight up "tmux attach -d" and steal your logged in root shell.