Hacker News Reader

Comment by i_think_so | Hacker News Reader

Oh come on, you know what I'm saying. It's small when written in python, which means any skid can spew it into a server he's got a shell on and get root in 2 seconds. He doesn't need to hope there's already a compiler installed, nor does he need to download some big tool. Just:

  cat | python3 && su
  <puke>, Ctrl-D

And I'm sure it can be refined into something much more likable to the spooky types, if they haven't already done it.

View on HN

Again, Linux LPE via either vulns or misconfigured permissions / binaries is common.

People who run servers that give out shell access to uses or randos already needed to contend with this.

Added later: you may find https://gtfobins.org/ fascinating or horrifying.

This is such a 1996 argument. It really was a big deal back then whether you had compilers on your multiuser SunOS boxes, because attackers would then use them to compile exploit.c.

The whole thread, really bringing me back to comp.security.unix. I'm not complaining! I miss comp.security.unix.

Reply on news.ycombinator.com