[TUHS] shell escapes in utilities

[Steffen Nurpmeso]

Niklas Karlsson wrote in
 <CAK6BEgegH3TeE4ETM489s70jV4xDFzEJF1EV7u2QPkHEr4pCFA at mail.gmail.com>:
 |Den tis 1 aug. 2023 kl 20:43 skrev Ron Natalie <ron at ronnatalie.com>:
 |> I remember IBM sending me an early RS/6000.    Booted the
 |> thing up but had no clue what root or any other password was.
 |> So, I set to work hacking on it.   Now this thing had a physical key on
 |> the front.   Off, On, and a Wrench symbol.   OK, let’s try the wrench.
 |>   Boots up some sort of maintenance program.   After playing around with
 |> it a bit I find a help option.    This starts up a paginator (more or pg
 |> or something).    Sure enough you can shell escape otu of that.
 |> Instant root shell.    Now it’s trivial to change the root password and
 |> reboot in normal mode.
 |
 |To be fair, local root exploits are a bit of a different animal from
 |remote ones. Even now, if you have physical access to your average *nix
 |box, you can likely gain root. Sure, there are ways and means of

I find this a provocative statement even in the silly saison.
I would assume that despite EFI firmware snooping key presses when
entering the disk key on cold boot, or other sort of nifty spying
(the famous USB sticks that "turn into keyboards and send key
presses" (as root?) cross my mind), i would think that you have
a hard time as a normal user to become root.  On this box; even
though you are not further separated via "ip netns exec .. unshare
.." etc.; some SETUID programs exist

  $ find /sbin /bin /usr/sbin /usr/bin -perm /4000
  /sbin/unix_chkpwd
  /bin/ping
  /bin/umount
  /bin/mount
  /bin/ksu
  /usr/bin/fusermount
  /usr/bin/crontab
  /usr/bin/doas
  /usr/bin/slock
  /usr/bin/traceroute
  /usr/bin/newuidmap
  /usr/bin/newgidmap
  /usr/bin/passwd
  /usr/bin/newgrp
  /usr/bin/expiry
  /usr/bin/chsh
  /usr/bin/chfn
  /usr/bin/chage
  /usr/bin/su

 |preventing that, but IME it's really only people doing really secret
 |spook stuff that bother with those. Even engineering outfits with big
 |secrets to protect usually don't bother.
 |
 |What you did with that RS/6000 sounds roughly equivalent to booting a
 |modern Linux box in single-user mode, where you can also set the root
 |password to anything you like.

Not here.

 |Niklas

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)