Hacker News Reader

Comment by dozzie | Hacker News Reader

I've seen them ask how to restore execution permissions after `chmod a-x /bin/chmod'. I usually answer to those smartasses that I my favourite way is to run the very non-executable /bin/chmod without any file juggling. I'm yet to meet anybody who wasn't surprised that it's possible.

View on HN

explain?

Manually call e.g. /lib/ld-linux.so.2 (man ld.so for more info).

    shabble@host:~$ cp /bin/chmod /tmp/chmoo
    shabble@host:~$ chmod 600 /tmp/chmoo
    shabble@host:~$ ll /tmp/ch*
    -rw------- 1 shabble shabble 59K Nov 21 17:15 /tmp/chmoo
    shabble@host:~$ /tmp/chmoo
    -bash: /tmp/chmoo: Permission denied
    shabble@host:~$ /lib64/ld-linux-x86-64.so.2 /tmp/chmoo
    /tmp/chmoo: missing operand
    Try '/tmp/chmoo --help' for more information.

Well, that's a new one on me. I'd just have 'cat'ted the chmod executable onto some other executable, which keeps the permissions.

This technique fails if chmod is compiled statically.

I'm a little surprised some smartypants hasn't come along and added a check to ld to prevent this from working, probably for "security" reasons.

I've known about this trick for a long time, but I've always thought its days were numbered.

Another way to solve the problem:

  scp unfuckedhost:/bin/chmod . 
  ./chmod (stuff)

This is my go-to method for doing that. Years ago, in the 90s, I used that trick (with ftp) to overwrite a custom login script used to "prevent" users from logging in. You'd login and it would spit out like "You are not allowed to login!" and then immediately log you out. Well, ftp (this is before sftp or scp) let me copy over that. This was actually one of the computers used by the newspaper in the next town over. I'm still shocked actually that the worst I ever got from the sysadmin there was a stern phone call.

Reply on news.ycombinator.com