/bin/sh: the biggest Unix security loophole (1984) [pdf]
22 points by vitplister 2 days ago | 10 comments
  • zahlman 2 days ago |
    Interesting piece of history. The actual exploit techniques have a real flavour of SQL injection about them.
  • supriyo-biswas a day ago |
    Loopholes of this kind exist these days as well.

    When I was working for a major retailer, who, you'd assume would have thought about these things well enough, you were prevented from executing sudo, except for being able to use it for text editing (sudo vi). I needed to install some packages with a root shell at the time, so I used the command execution feature within vi to get that.

    • netsharc a day ago |
      In the Middle Ages, when Internet access wasn't in your pocket all the time, I was in a hostel which had Internet kiosks, you'd put a coin in a machine, and the PC would start 2 browser windows: 1 with just a countdown, and one for you to browse. You'd have to put more coins or when the time ends the browser would be killed.

      Of course there was nothing else in the UI except this window and the browser, but on ancient Firefox, in the print window you had the option to specify the command line to print. I tried "xterm", hit "Print", and voila, a prompt!

      Using ps, I managed to figure out the difference between the unpaid browser and the paid one, and next time around I could launch a browsing session without payment...

    • tiberious726 a day ago |
      My favorite is pressing '!' while inside a sudoed or setuid less.
    • denysvitali a day ago |
      There's a collection of these binary escapes: https://gtfobins.github.io/
    • more_corn a day ago |
      I once encountered a good anti sudo control. Execute sudo and you get a warning “log in as root instead!” Firstly, no Secondly did you just “prevent” sudo by aliasing it?
    • raffraffraff a day ago |
      Not too mention that you can edit anything you want, like the sudoers file.
    • akimbostrawman 11 hours ago |
      I would assume sudoedit could have preventing that
  • chrisding a day ago |
    Interesting piece of history.
  • pengaru a day ago |
    Wow, they even used the accurate term "crackers", I feel so old.