Hello guys,

I have got a problem testing out a Linux Command injection. I wanted
to test it myself with a self-programmed code with this vulnerability
included, whose basic structure I got from the OWASP wiki (see at the
bottom for the source).

I SUID-ed the program file I created (rwsr-xr-x; owner is root), added
a new user and then tried to inject commands with this user.
But that didn't work because when I call the program with for
example: ./program "ls; cat /etc/shadow" (to use OWASP's suggestion),
then it tells me "cat: /etc/shadow: Permission denied".
It appears as if the program runs correctly and that the cat /etc/
shadow command gets invoked after the script already terminated, thus
getting invoked with the rights of the user and thus the permission is
denied. That would signal that the injection didn't work ... but I
don't know any other possibility to do it?

Can anybody point me to something?

The Source:
#include <stdlib.h
#include <stdio.h
#include <string.h

int main(int argc, char **argv)
{
char command[256];

memset(&command, 0, sizeof(command));

strcat(command, "time ./");
strcat(command, argv[1]);

system(command);
return 0;
}

On 2009-06-06, Der_Kanzler <osmo.sis at (no spam) lycos.com> wrote:
Hello guys,

I have got a problem testing out a Linux Command injection. I wanted
to test it myself with a self-programmed code with this vulnerability
included, whose basic structure I got from the OWASP wiki (see at the
bottom for the source).

I SUID-ed the program file I created (rwsr-xr-x; owner is root), added
a new user and then tried to inject commands with this user.
But that didn't work because when I call the program with for
example: ./program "ls; cat /etc/shadow" (to use OWASP's suggestion),
then it tells me "cat: /etc/shadow: Permission denied".
It appears as if the program runs correctly and that the cat /etc/
shadow command gets invoked after the script already terminated, thus
getting invoked with the rights of the user and thus the permission is
denied. That would signal that the injection didn't work ... but I
don't know any other possibility to do it?

Can anybody point me to something?
[snip]

Try to set the uid with setuid(0):
#include <stdlib.h
#include <stdio.h
#include <string.h

int main(int argc, char **argv)
{
char command[256];

memset(&command, 0, sizeof(command));

seteuid(0);

strcat(command, "time ./");
strcat(command, argv[1]);

system(command);
return 0;
}

Can anybody point me to something?
system(command);

On Sat, 06 Jun 2009 08:06:43 -0400, Der_Kanzler <osmo.... at (no spam) lycos.com> wrote:
Can anybody point me to something?
     system(command);

 From "man system" ...

Do not use system() from a program with set-user-ID or set-group-ID privileges, because strange
        values  for  some  environment  variables  might  be used to subvert system integrity.  Use the
        exec(3) family of functions instead, but not execlp(3) or execvp(3).   system()  will  not,  in
        fact,  work  properly  from  programs with set-user-ID or set-group-ID privileges on systems on
        which /bin/sh is bash version 2, since bash 2 drops privileges on startup.  (Debian uses a mod‐
        ified bash which does not do this when invoked as sh.)

Regards, Dave Hodgins

--
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)

However, with execv() or execl() I don't seem to be able to execute
that command (and then inject an own one) properly, because it tells
me that "the argument for execv is of an incompatibe pointer
type"

The Source:

#include <stdlib.h
#include <stdio.h
#include <string.h

int main(int argc, char **argv)
{
char command[256];

memset(&command, 0, sizeof(command));

strcat(command, "time ./");
strcat(command, argv[1]);

system(command);
return 0;

}