Hacker News Reader

Comment by throwmenow_0140 | Hacker News Reader

agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off):

  alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo'

I don't think it matters that he used his root account.

Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... https://askubuntu.com/a/318476

Edit: Last exploit for Linux remote exploitation with Flash is from 2015 https://www.rapid7.com/db/modules/exploit/multi/browser/adob... or did I miss something here?

View on HN

As an attacker, I test for sudo -n. If it succeeds, I have root. In most cases I do not need it however. SSH key trusts, SSH multiplexing and bad posix permissions are more than enough to get me anywhere and grab anything.

I'm going to make a separate account just to run the web browser, xhost +localhost && su -c web-browser unprivileged-user

If you're using xwindows they can just install a keylogger

There was a zero-day for Flash being exploited ITW just a few days ago.

I didn't think any browser on Linux still supported Flash.

I use /usr/bin/sudo <>

So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

Hm. How about ‘sudo’ <> ? i.e. quote the command?

Based on the sibling comment to yours, I don't think bash supports this. zsh allows you to make a \'sudo\' alias though, so it depends on your shell.

At least in bash, quoting the command disables any alias. Maybe also in zsh?

zsh seems to have much more flexible alias rules than bash:

    > alias \'sudo\'='ls -a'
    > 'sudo'                
    .  ..

If they have access to your .bashrc they can also alter your PATH and create a script named sudo somewhere they have write access to that carries the malicious payload. So you're not gaining much by adding the quotes.

> So they check .bash_history and then they realize they just need to also `alias /usr/bin/sudo`.

    $ alias /usr/bin/sudo=whatever
    bash: alias: `/usr/bin/sudo': invalid alias name

Oh, fair point. Not all shells support this apparently. zsh does:

    -> alias /usr/bin/sudo='ls -a'
    -> /usr/bin/sudo
     .  ..

Reply on news.ycombinator.com