Hacker News Reader

Comment by zaarn | Hacker News Reader

This is quite ungood considering how many devices (read: routers, IoT) have busybox (or some zombie-like corpse of it) installed on them.

View on HN

Hi, I'm the author of the article. To stress your point, there really are so many embedded devices using Busybox, and most of them were never designed to be updated (or nobody cares enough to update them).

Also I never got to fuzzing networking applets (wget is the most obvious) but this is definitely something I plan to look into, if no one did that before, there are definitely vulnerabilities there too.

When you ssh to your device are you not running Busybox shell on the device? I don't understand why this is less of a problem?

Yes absolutely. Whew. Updated my comment accordingly, thanks.

It could be good for me. We ($work) have some embedded devices running BusyBox that we only have limited (i.e. non-root) access to. I'm looking forward for a way to escalate privileges on these devices as a result of this!

How do you get privilege escalation from shell escape sequences?

It would be a stretch, but lets say you're driving some poorly thought out automation over a pty that has some sort of terminal emulator attached that has any sort of output-changeable answerback-like sequence.

The pty part is important because some software will assume you're running interactive if it sees that its STDIN/OUT is a pty, and change its functionality accordingly.

Crazier shit has happened. In my case, pretty much everything on these devices runs as root so it may very well be possible.

The vulnerability is that you can play tricks on interactive users' output. In general people (besides nerds) aren't shelling into these devices so it really doesn't seem like that big of a deal.

I quite often shell into such devices. I think just playing tricks is a start and can easily escalate into something more serious.

Alpine also uses Busybox by default (IIRC) and people will use that definitely so it's definitely a problem.

Busybox is not only used in embedded devices.

Reply on news.ycombinator.com