Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: No shell => secure?
From: hax <uberhax () gmail com>
Date: Thu, 8 Jul 2004 22:34:18 -0400

I'm not an expert in shellcode, but that thinking seems flawed in a few ways:
1)  Tons of scripts rely on /bin/sh being present.  It'd be a huge
deal to rework the system so that everything goes to a new path.
2)  That'd stop a lot of skript kiddies, I guess, but it'd be pretty
trivial to just rework the shellcode to call some other command
instead of /bin/sh.  Everything from vi to mozilla can execute
commands these days.
3)  Changing the file system structure is a *bad* idea.  You'd be
breaking standards (http://www.pathname.com/fhs/) and you'd probably
be breaking most applications.  Think about how linking works, for
example, and all the absolute references programs make.

The moral of the story is that security through obscurity is *bad*.
You wouldn't really be making yourself much safer, although you'd stop
some of the mass exploitation scripts, and you'd cause yourself a lot
of problems trying to make your obscurity function.
Besides, if everyone tried what you suggest, shellcode would just move
away from /bin/sh.

Good thoughts, bad idea ;)

Hope that helps,

On Thu, 8 Jul 2004 12:04:53 +0200, Matthias Benkmann
<msbremove-this () winterdrache de> wrote:
I can't say I've looked at much exploit-code so far but the POC exploits
to gain root I've seen for Linux all executed /bin/sh. I'd like to know if
this is true for in-the-wild exploits to root a box, too. If so, would it
be a useful security measure to rename /bin/sh and other shells (after
making sure that everything that needs them has been updated to the new
name, of course)?

I'm aware that a dedicated attacker who targets my box specifically will
not be stopped by this but I don't think I have such enemies. I also know
that DOS is still possible, but that's also not my concern. I'm simply
worried about script kiddies using standard exploits against random
servers on the Internet rooting my box faster than I can patch it.

If renaming the shell is not enough, how about renaming all of the
standard Unix top-level directories (such as /bin, /etc,...)? Would that
defeat standard exploits to root a box?


Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]